CVE-2026-64907: Microsoft Word Buffer Overflow Vulnerability

CVE-2026-64907 Overview

CVE-2026-64907 is a stack-based buffer overflow vulnerability in Microsoft Office Word. The flaw allows an unauthorized attacker to execute arbitrary code locally on a victim's machine. Exploitation requires user interaction, typically opening a maliciously crafted Word document. The vulnerability maps to [CWE-121] Stack-based Buffer Overflow. Microsoft published the advisory on 2026-08-11, and the record was last modified on 2026-08-12. The vulnerability affects confidentiality, integrity, and availability at the local scope, giving attackers full control over impacted user contexts once triggered.

Critical Impact
Successful exploitation grants an attacker the ability to execute arbitrary code in the context of the user opening the crafted Word document, enabling persistence, data theft, and lateral movement staging.

Affected Products

Microsoft Office Word (specific builds pending vendor enumeration in the Microsoft Security Update Guide)
Microsoft 365 Apps installations that include Word
Standalone Microsoft Office installations containing the vulnerable Word component

Discovery Timeline

2026-08-11 - CVE-2026-64907 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-64907

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow [CWE-121] in Microsoft Office Word's document parsing logic. When Word processes a crafted document, unchecked input is copied into a fixed-size stack buffer. The overflow overwrites adjacent stack memory, including saved return addresses and structured exception handler pointers. An attacker who controls the overflow contents can redirect execution to attacker-supplied shellcode or return-oriented programming (ROP) gadgets. Because the flaw resides in a local desktop application, exploitation runs in the security context of the user who opened the document.

Root Cause

The root cause is missing or insufficient bounds checking during parsing of a document field or embedded object structure. Word copies attacker-controlled data of an untrusted length into a fixed-size stack buffer. Modern mitigations such as stack cookies, Address Space Layout Randomization (ASLR), and Control Flow Guard (CFG) raise the exploitation bar but do not eliminate the memory corruption primitive.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a weaponized .doc, .docx, or related Word document through phishing email, a shared drive, or a download link. When the target opens the file, or in some cases previews it, the malformed structure triggers the overflow. Code execution occurs before macro prompts, meaning Protected View and macro-blocking policies may not prevent exploitation. Sandboxing within Protected View reduces but does not eliminate the impact.

No public proof-of-concept exploit or in-the-wild exploitation has been reported at the time of publication. See the Microsoft Security Update Guide entry for CVE-2026-64907 for authoritative technical details.

Detection Methods for CVE-2026-64907

Indicators of Compromise

Unexpected child processes spawned by winword.exe, such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Word processes making outbound network connections shortly after opening a document from email or an internet zone.
Crash dumps of winword.exe referencing stack corruption or __report_gsfailure stack cookie violations.
Newly written executables or scripts in %APPDATA%, %TEMP%, or user startup folders following document open events.

Detection Strategies

Alert on winword.exe spawning script interpreters or LOLBins, which is a common post-exploitation pattern for Office memory-corruption bugs.
Monitor for Word processes loading unusual DLLs from user-writable paths, indicating post-exploitation staging.
Hunt for documents delivered via email with unusual embedded objects, ActiveX controls, or malformed OLE structures.
Correlate Windows Error Reporting (WER) crash events for winword.exe with subsequent suspicious process activity.

Monitoring Recommendations

Ingest Microsoft Defender for Endpoint or equivalent EDR telemetry for Office child-process and image-load events.
Enable and forward Sysmon Event IDs 1 (process create), 7 (image load), and 11 (file create) from Office-heavy user populations.
Track email gateway detections of Word attachments with anomalous structure or macro content.
Log and review Attack Surface Reduction (ASR) rule triggers, particularly the rule blocking Office applications from creating child processes.

How to Mitigate CVE-2026-64907

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-64907 to all systems running Microsoft Office Word as soon as testing permits.
Prioritize patching for users who routinely process externally sourced documents, including finance, HR, and executive assistants.
Enforce Protected View for documents originating from the internet, email attachments, and unsafe locations.
Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and from injecting into other processes.

Patch Information

Microsoft has released a security update addressing CVE-2026-64907. Refer to the Microsoft Security Update Guide entry for CVE-2026-64907 for the current list of affected builds, Knowledge Base article identifiers, and package downloads. Deploy the update through Microsoft Update, Windows Server Update Services (WSUS), Microsoft Intune, or Microsoft Configuration Manager according to your patch management workflow.

Workarounds

Block or quarantine inbound .doc, .docm, and .rtf attachments at the email gateway until patches are deployed.
Configure Group Policy to open all Word documents from untrusted zones in Protected View and disable ActiveX controls.
Restrict macro execution using the "Block macros from running in Office files from the Internet" policy.
Use application control frameworks such as Windows Defender Application Control (WDAC) or AppLocker to prevent Word from launching script hosts and command shells.

bash

# Example Group Policy registry configuration to enforce Protected View and block internet-origin macros for Word
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security" /v BlockContentExecutionFromInternet /t REG_DWORD /d 1 /f