CVE-2026-65661: Microsoft Office Buffer Overflow Flaw

CVE-2026-65661 Overview

CVE-2026-65661 is a heap-based buffer overflow vulnerability in Microsoft Office that allows an unauthorized attacker to execute code locally. The flaw is classified under [CWE-122] (Heap-based Buffer Overflow) and requires user interaction to trigger. An attacker crafts a malicious Office document that, when opened by a victim, corrupts heap memory and permits arbitrary code execution in the context of the current user.

Microsoft published the advisory on August 11, 2026. Because Office is broadly deployed across enterprise endpoints, phishing campaigns delivering weaponized documents are the most likely delivery mechanism for this class of vulnerability.

Critical Impact
An attacker who convinces a user to open a crafted Office document can execute arbitrary code locally with the privileges of the logged-in user, enabling malware installation, credential theft, and lateral movement.

Affected Products

Microsoft Office (specific versions detailed in the Microsoft Security Update CVE-2026-65661 advisory)
Microsoft 365 Apps (subject to Microsoft's servicing branch for Office)
Office desktop installations on Windows where document rendering components are present

Discovery Timeline

2026-08-11 - CVE-2026-65661 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-65661

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow [CWE-122] within a Microsoft Office document parsing or rendering component. When Office processes a specially crafted file, an insufficiently validated size or length field causes a write past the bounds of a heap-allocated buffer. This overwrite can corrupt adjacent heap structures, function pointers, or object virtual tables used later during execution.

Exploitation is local and requires user interaction, meaning the victim must open or preview the malicious document. Successful exploitation yields code execution in the context of the Office process, which typically runs at the user's privilege level. Attackers commonly pair this primitive with follow-on payloads for persistence, defense evasion, and privilege escalation.

Root Cause

Heap-based buffer overflows in Office historically originate from improper bounds checking when parsing structured document formats such as OOXML, RTF, or legacy binary formats. A length field controlled by the attacker is trusted without validation against the allocated buffer size, causing an out-of-bounds heap write. See the Microsoft Security Update CVE-2026-65661 advisory for vendor-supplied technical details.

Attack Vector

The attack vector is local with required user interaction. A typical exploitation chain involves an attacker distributing the malicious document via phishing email, cloud file share, or drive-by download. When the recipient opens the file, the parser processes the malformed structure, triggers the heap overflow, and diverts execution to attacker-controlled code. Protected View may mitigate initial execution if the document is flagged as Mark-of-the-Web content.

Detection Methods for CVE-2026-65661

Indicators of Compromise

Office application processes (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE) spawning child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Unexpected outbound network connections initiated by an Office process shortly after a document open event.
Office processes writing executable content (.exe, .dll, .js, .hta) into user-writable directories like %TEMP% or %APPDATA%.
Crash or Watson telemetry indicating heap corruption within an Office process handling an external document.

Detection Strategies

Hunt for parent-child process anomalies where Office applications launch scripting or living-off-the-land binaries.
Inspect email gateways for attachments with Office file extensions originating from external senders, especially those bypassing Protected View through embedded objects.
Correlate Office process crashes with subsequent suspicious child process creation or file writes.

Monitoring Recommendations

Enable and forward Microsoft Defender for Office 365 and Windows Defender Exploit Guard telemetry to a central SIEM.
Monitor endpoint EDR telemetry for behavioral chains linking document open, process injection, and outbound C2 traffic.
Track patch deployment status for Microsoft Office across the fleet and alert on hosts running unpatched builds.

How to Mitigate CVE-2026-65661

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-65661 advisory to all affected Office installations.
Prioritize patching for users who routinely receive external Office documents, including finance, HR, and executive assistants.
Verify that Protected View and Office Attack Surface Reduction (ASR) rules are enforced across managed endpoints.

Patch Information

Microsoft has released a security update addressing CVE-2026-65661. Administrators should deploy the fix through Microsoft Update, WSUS, Microsoft Intune, or Configuration Manager. Refer to the Microsoft Security Update CVE-2026-65661 for build-specific version information and detection guidance.

Workarounds

Enforce Protected View for documents originating from the internet, email attachments, and unsafe locations.
Enable ASR rules such as Block all Office applications from creating child processes and Block Win32 API calls from Office macros.
Disable legacy file format support (for example, older binary Office formats) where operationally feasible.
Route inbound Office attachments through a sandbox or Safe Attachments service before delivery to end users.

bash

# Enable the ASR rule blocking Office child processes (PowerShell, run as admin)
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Confirm rule status
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids