CVE-2026-64898 – Microsoft Office Remote Code Execution Vulnerability

CVE-2026-64898 is a Critical remote code execution vulnerability in affected Microsoft Office products. A heap-based buffer overflow involving an integer overflow or wraparound can allow an unauthorized attacker to execute code locally. An attacker can send a malicious Office file and convince a user to open it; the Preview Pane is also an attack vector. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVSS Score: 7.8.

SEVERITY: Critical.

THREAT:
An attacker can craft a malicious Office file that triggers the vulnerability when processed on an affected system. The attack has low complexity and requires no privileges, but user interaction is required. Successful exploitation can execute attacker-controlled code and compromise the confidentiality, integrity, and availability of the affected system.

EXPLOITS:
This vulnerability was not publicly disclosed and was not known to be exploited at the time of publication. Exploit code maturity is rated Unproven. The source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept code.

TECHNICAL SUMMARY:
CVE-2026-64898 is caused by a heap-based buffer overflow associated with an integer overflow or wraparound in Microsoft Office. An attacker must deliver a specially crafted Office file and have it processed on the victim's system. Opening the malicious file can trigger exploitation, and the Preview Pane is also identified as an attack vector. Although the vulnerability is classified as remote code execution because the attacker may operate remotely, the actual code execution occurs locally on the affected machine. Successful exploitation can result in unauthorized code execution with high confidentiality, integrity, and availability impact.

EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise 32-bit and 64-bit, Office 2019 32-bit and 64-bit, Office LTSC 2021 and 2024 32-bit and 64-bit, Microsoft Office 365 for Mac, and Office LTSC for Mac 2021 and 2024. Exploitation requires no privileges but does require user interaction with a malicious Office file; the Preview Pane can also be an attack vector.

BUSINESS IMPACT:
Successful exploitation could allow attacker-controlled code to run on an employee's system, potentially exposing sensitive information, altering data, or disrupting system availability. Malicious Office documents are particularly concerning in business environments because document-based workflows can provide an attacker with a practical route to target users.

WORKAROUND:
No workaround or mitigation is identified. An official fix is available, making deployment of the security update the primary remediation.

URGENCY:
This patch should be prioritized because the vulnerability carries a Critical severity rating and can result in remote code execution with high confidentiality, integrity, and availability impact. Although exploitation is assessed as less likely and no exploitation is currently reported, a malicious Office file can exploit the issue without requiring attacker privileges.