CVE-2026-65657 – Microsoft Office Remote Code Execution Vulnerability

CVE-2026-65657 is a critical use-after-free vulnerability in Microsoft Office that can allow an unauthorized attacker to execute code locally. An attacker must convince a user to open a malicious Office file, and the Preview Pane is also identified as an attack vector. Exploitation requires no privileges but does require user interaction.

CVSS Score: 7.8.

SEVERITY: Critical.

THREAT:
Successful exploitation can result in arbitrary code execution on an affected system. The vulnerability has high confidentiality, integrity, and availability impacts, creating the potential for sensitive information exposure, unauthorized modification, and disruption of affected systems.

EXPLOITS:
The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as unproven. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY:
CVE-2026-65657 is caused by a use-after-free weakness (CWE-416) in Microsoft Office. The attack vector is classified as local with low attack complexity, no privileges required, and user interaction required. An attacker can send a malicious Office file and convince the intended victim to open it. The Preview Pane can also serve as an attack vector. Although the vulnerability is titled remote code execution because the attacker may be remote, exploitation itself involves code being executed from the local machine. Successful exploitation can execute code and cause high confidentiality, integrity, and availability impacts.

EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Office 2019 (32-bit and 64-bit), Office LTSC 2021 and 2024 (32-bit and 64-bit), Microsoft Office 365 for Mac, and Office LTSC for Mac 2021 and 2024. Exploitation requires a malicious Office file to be opened by a user; the Preview Pane is also an attack vector.

BUSINESS IMPACT:
Successful exploitation could allow unauthorized code execution on business endpoints and place sensitive information, system integrity, and service availability at risk. A malicious Office document could therefore become an entry point for significant compromise when handled on a vulnerable system.

WORKAROUND:
No workaround or mitigation is identified. An official fix is identified as the remediation.

URGENCY:
This vulnerability is rated Critical and can lead to remote code execution with high confidentiality, integrity, and availability impacts. Organizations should prioritize deployment of the official fix across affected Microsoft Office installations, particularly because exploitation requires no existing privileges.