CVE-2026-64905: Microsoft Word RCE Vulnerability

CVE-2026-64905 Overview

CVE-2026-64905 is a buffer over-read vulnerability in Microsoft Office Word that allows an unauthorized attacker to execute code locally. The flaw is categorized under [CWE-126] (Buffer Over-read) and carries a CVSS 3.1 base score of 7.8. Exploitation requires local access and user interaction, typically through opening a crafted Word document. Successful exploitation impacts confidentiality, integrity, and availability at the user's privilege level.

Critical Impact

An attacker who convinces a user to open a specially crafted document can execute arbitrary code in the context of the current user, leading to full compromise of user data and session privileges.

Affected Products

• Microsoft Office Word (see the Microsoft Security Update Guide for exact affected builds)

Discovery Timeline

• 2026-08-11 - CVE-2026-64905 published to NVD
• 2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-64905

Vulnerability Analysis

The vulnerability stems from a buffer over-read condition in Microsoft Office Word's document parsing logic. Word reads data past the end of an intended buffer boundary while processing structured content inside a document file. This out-of-bounds read exposes adjacent memory and, under specific conditions, corrupts control-flow data used later during parsing.

An attacker crafts a malicious .doc, .docx, or related Office document that triggers the flawed parsing path. When the victim opens the document, Word processes the malformed structure and executes attacker-controlled code in the user's security context. The attack requires user interaction, which aligns with the typical phishing delivery model used against Office file formats.

Because the process runs at the user's privilege level, code execution enables credential theft, lateral tooling deployment, and staging of additional payloads. Full technical specifics are limited in the public advisory. Refer to the Microsoft Security Update Guide for authoritative details.

Root Cause

The root cause is improper bounds checking during structured document parsing, classified as [CWE-126] Buffer Over-read. Word trusts a length or offset field from the file without validating it against the actual buffer size, causing reads beyond allocated memory.

Attack Vector

The attack vector is local and requires user interaction. An attacker typically delivers the malicious document through email, a shared drive, a messaging platform, or a web download. The vulnerability triggers when the user opens the file in a vulnerable version of Word, including scenarios where the Preview Pane renders document content.

No verified public proof-of-concept code is available at this time. Refer to vendor documentation for exploitation prerequisites.

Detection Methods for CVE-2026-64905

Indicators of Compromise

• Unexpected child processes spawned by winword.exe, such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
• Word writing executable content to %TEMP%, %APPDATA%, or user profile directories immediately after opening a document.
• Outbound network connections originating from winword.exe to unfamiliar external hosts shortly after document open events.
• Crashes or abnormal termination of winword.exe correlated with opening documents from untrusted sources.

Detection Strategies

• Hunt for anomalous process ancestry where winword.exe is the parent of scripting or LOLBAS binaries.
• Monitor for suspicious file writes by Office processes to autorun locations such as Startup, Run registry keys, or scheduled task paths.
• Flag Office applications loading unexpected DLLs from user-writable directories, which can indicate side-loading after initial code execution.

Monitoring Recommendations

• Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office child process creation and executable content creation.
• Ingest endpoint telemetry into a centralized data lake for behavioral correlation across users receiving similar documents.
• Alert on repeated Word crash events across multiple users, which can indicate an exploitation campaign in progress.

How to Mitigate CVE-2026-64905

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all systems running Microsoft Office Word.
• Prioritize patching for users who routinely handle documents from external sources, such as finance, HR, and executive assistants.
• Enforce Protected View and Office file block policies for documents originating from the internet or email attachments.
• Disable the Outlook Reading Pane and Windows Explorer Preview Pane for Office file types until patches are deployed.

Patch Information

Microsoft has released a security update addressing CVE-2026-64905. Consult the Microsoft Security Update Guide for the specific KB articles, affected build numbers, and deployment guidance for each Office channel (Current Channel, Monthly Enterprise Channel, and Semi-Annual Enterprise Channel).

Workarounds

• Enable Microsoft Defender ASR rule "Block all Office applications from creating child processes" to reduce post-exploitation impact.
• Configure Office File Block policy to prevent opening legacy Word binary formats from untrusted locations.
• Deliver user awareness reminders to avoid enabling editing or content on unexpected documents.

# Example: enable Defender ASR rule to block Office child process creation
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled