What is the CVSS score of EUVD-2026-56749?

EUVD-2026-56749 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Microsoft Office are affected by EUVD-2026-56749?

A high-severity vulnerability in Microsoft Office (CVE-2026-66807) allows arbitrary code execution when users open maliciously crafted documents.. A patch is available.

How to fix or mitigate EUVD-2026-56749?

Within 24 hours, identify all Office deployments across the organization and assess user-facing risk; communicate vulnerability status to security and IT teams and prepare incident response protocols. Over the next 7 days, deploy compensating controls including email filtering rules to block suspicious Office attachments, enable Attack Surface Reduction rules (disable Office child processes), enforce macro blocking via Group Policy, and issue user awareness guidance to report suspicious documents. Within 30 days, continuously monitor Microsoft security advisories for patch availability and establish a rapid deployment process for when the fix is released.

Microsoft Office EUVD-2026-56749

| CVE-2026-66807 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-08-11 secure@microsoft.com

GHSA-v63q-fh49-r4gg

Buffer Overflow Microsoft Stack Overflow Red Hat 365 Apps Microsoft 365 Office 2021 Office 2024 Office 2019

High

Disputed · 7.8 Vendor: microsoft

Severity by source

Sources disagree (Low–High)

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local file-based delivery (AV:L) with mandatory user interaction (UI:R); no system authentication needed (PR:N); full impact triad warranted for arbitrary code execution.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

3.1 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 18:12 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 7.8

DescriptionCVE.org

Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Stack-based buffer overflow in Microsoft Office enables local arbitrary code execution when a user opens a specially crafted document. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms exploitation is local and requires user interaction - most likely triggered by opening a maliciously crafted Office file delivered via phishing or other social engineering. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis, though the high-impact triad (C:H/I:H/A:H) and Microsoft Office's ubiquitous deployment footprint make this a notable patching priority.

Technical ContextAI

CWE-121 (Stack-based Buffer Overflow) describes a condition where attacker-controlled input exceeds the bounds of a fixed-size stack buffer, overwriting the return address or adjacent control-flow data and redirecting execution. In the Microsoft Office context, this class of vulnerability typically resides in document format parsers - processing fields such as record sizes, string lengths, or embedded object metadata in formats like .doc, .xls, .pptx, or legacy binary formats. The AV:L attack vector indicates the malicious payload must reside on the local filesystem (i.e., a crafted file), with UI:R confirming that the overflow is triggered only upon user interaction such as opening the document. No CPE strings were provided, so exact affected component (e.g., Word, Excel, a shared parsing library) cannot be confirmed from available data alone; the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66807 should be consulted for component specifics.

RemediationAI

Apply the vendor-released security update via Microsoft Update, Windows Update for Business, or the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66807. An exact patched version number is not independently confirmed from the available data - consult the MSRC advisory for the specific KB article and build numbers. As an interim compensating control, enforce Protected View in Microsoft Office via Group Policy (File Block settings) to sandbox documents opened from the internet, email attachments, or untrusted locations - note this may impact legitimate document workflows requiring editing upon open. Additionally, user awareness training to avoid opening unsolicited Office documents reduces the social engineering exposure inherent to UI:R vulnerabilities. Blocking execution of documents from untrusted sources via Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint provides an additional defense layer without impacting documents from trusted paths.