CVE-2026-64907 – Microsoft Office Word Remote Code Execution Vulnerability

CVE-2026-64907 is a Critical remote code execution vulnerability caused by a stack-based buffer overflow in Microsoft Office Word. An attacker can send a specially crafted Office file and convince a user to open it. The resulting attack executes locally and can compromise confidentiality, integrity, and availability. The vulnerability requires no attacker privileges but does require user interaction.

CVSS Score: 7.8.

SEVERITY: Critical.

THREAT:
An unauthorized attacker could use a malicious Office document to trigger a stack-based buffer overflow and execute code on the affected system. Attack complexity is Low, privileges are not required, and successful exploitation could have a High impact on confidentiality, integrity, and availability.

EXPLOITS:
The vulnerability is not publicly disclosed and is not currently reported as exploited. Exploit code maturity is Unproven, and the exploitation assessment is Exploitation Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY:
CVE-2026-64907 is a stack-based buffer overflow, identified as CWE-121, affecting Microsoft Office Word. Exploitation requires an attacker to send a malicious Office file and persuade a user to open it. Although the vulnerability is categorized as remote code execution because the attacker may be remote, the actual attack vector is Local: code must be executed from the victim's local machine. The vulnerability has Low attack complexity, requires no privileges, and requires user interaction. Successful exploitation allows code execution and can result in High confidentiality, integrity, and availability impact.

EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office 2019 (32-bit and 64-bit), Microsoft Office 365 for Mac, Microsoft Office LTSC 2021 and 2024 (32-bit, 64-bit, and listed Mac editions), and Microsoft Word 2016 (32-bit and 64-bit). Exploitation requires the victim to open a malicious Office file sent by an attacker.

BUSINESS IMPACT:
Successful exploitation could allow unauthorized code execution on employee systems, potentially exposing sensitive information, allowing unauthorized modification of data, or disrupting system availability. A convincing malicious document could therefore turn normal document handling into a route for system compromise.

WORKAROUND:
No mitigations or workarounds are identified. An official fix is identified as the remediation.

URGENCY:
This vulnerability carries a Critical severity rating and can result in code execution with High impact across confidentiality, integrity, and availability. Organizations using the affected Microsoft Office and Word products should prioritize deployment of the official fix, particularly where users routinely receive and open Office documents from external sources.