CVE-2026-64915: Microsoft Word Buffer Overflow Flaw

CVE-2026-64915 Overview

CVE-2026-64915 is a heap-based buffer overflow vulnerability in Microsoft Office Word. An unauthorized attacker can execute code locally by convincing a user to open a crafted document. The flaw is tracked under CWE-122, heap-based buffer overflow, and affects confidentiality, integrity, and availability at high impact. Exploitation requires user interaction, such as opening a malicious .doc or .docx file. Microsoft published the advisory on August 11, 2026 and assigned a CVSS 3.1 base score of 7.8.

Critical Impact
Successful exploitation grants arbitrary code execution in the context of the logged-in user, enabling attackers to install programs, view or modify data, or create new accounts with full user rights.

Affected Products

Microsoft Office Word (specific build ranges listed in the Microsoft Security Update Guide)
Microsoft 365 Apps deployments containing the Word component
Standalone Office installations that include Word

Discovery Timeline

2026-08-11 - CVE-2026-64915 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-64915

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow inside Microsoft Word's document parsing routines. When Word processes a specially crafted document, it writes past the boundaries of a heap-allocated buffer. The overflow corrupts adjacent heap metadata or object pointers, allowing an attacker to hijack execution flow. Because the attack executes in the same process as Word, the resulting code runs with the privileges of the current user. The Common Weakness Enumeration classification is CWE-122.

Root Cause

Heap-based buffer overflows in Office file parsers typically stem from missing or incorrect length validation on structured fields within the document format. Word parses complex binary and OOXML structures, and any parser path that trusts an attacker-controlled size field without bounding it against the destination buffer can trigger this class of memory corruption. Microsoft has not published low-level root-cause details beyond the advisory in the Microsoft Security Update Guide.

Attack Vector

The attack is local and requires user interaction. An attacker delivers a weaponized Word document through phishing email, a shared file location, a chat platform, or a drive-by download. When the victim opens the document, the parser processes the malformed structure and triggers the overflow. Preview Pane rendering can also be an exposure surface for Office parsers, though Microsoft's advisory should be consulted for the specific preconditions. No authentication is required to craft or deliver the payload. EPSS scoring on 2026-08-13 lists a 0.31% exploitation probability.

No public proof-of-concept code has been released. See the vendor advisory for the authoritative technical description.

Detection Methods for CVE-2026-64915

Indicators of Compromise

Word (WINWORD.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe
Office processes writing executable content to %AppData%, %Temp%, or startup folders
Crashes of WINWORD.EXE with heap corruption exceptions in Windows Error Reporting logs
Inbound documents containing malformed OLE, RTF, or OOXML structures flagged by mail gateway inspection

Detection Strategies

Hunt for WINWORD.EXE process trees where the child process is a scripting host or LOLBIN
Monitor for suspicious module loads and memory allocations with RWX permissions inside Office processes
Alert on Office applications initiating outbound network connections to non-Microsoft destinations shortly after document open
Correlate document open events with subsequent persistence writes to Run keys and scheduled tasks

Monitoring Recommendations

Enable and forward Microsoft Defender ASR rule telemetry, particularly the rule that blocks Office child process creation
Ingest Sysmon Event IDs 1, 7, 10, and 11 from workstations running Office and retain in a searchable data lake
Track Windows Error Reporting for repeated WINWORD.EXE faults that may indicate exploitation attempts or unstable payloads
Monitor email gateway telemetry for attachments with anomalous Word document structure metrics

How to Mitigate CVE-2026-64915

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Update Guide across all Office and Microsoft 365 Apps deployments
Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and injecting into other processes
Restrict macro execution and disable legacy binary formats where operationally feasible
Prioritize patch deployment on high-risk users such as executives, finance, HR, and any staff who routinely open external documents

Patch Information

Microsoft released fixed builds referenced in the security update guide entry for CVE-2026-64915. Administrators should deploy the update through Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, or their Microsoft 365 Apps update channel. Confirm the installed Word build number matches the fixed version documented in the advisory before removing compensating controls.

Workarounds

Open untrusted documents in Protected View and block editing until the source is verified
Configure Group Policy to force Office to open internet-sourced files in Protected View and to block macros from the internet
Disable the Outlook and File Explorer Preview Pane handlers for Word documents on high-risk endpoints until patching completes
Use Application Guard for Office to isolate untrusted documents in a hardware-backed container where supported

bash

# Group Policy registry values to harden Word against untrusted documents
# Enforce Protected View for files originating from the internet
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f

# Block macros in Office files from the internet
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security" /v BlockContentExecutionFromInternet /t REG_DWORD /d 1 /f

# Require macros to be signed
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security" /v VBAWarnings /t REG_DWORD /d 4 /f