CVE-2026-65664: Microsoft Office Buffer Overflow Flaw

CVE-2026-65664 Overview

CVE-2026-65664 is a heap-based buffer overflow vulnerability in Microsoft Office that permits local code execution. An unauthorized attacker can exploit this flaw by convincing a user to open a crafted document. Successful exploitation runs attacker-controlled code in the security context of the current user.

The vulnerability is categorized under [CWE-122] Heap-based Buffer Overflow. Microsoft has published a security update via the Microsoft Security Response Center (MSRC) advisory portal. The issue affects the Microsoft Office family of productivity applications.

Critical Impact
Attackers can achieve local code execution with full confidentiality, integrity, and availability impact after a user opens a malicious Office file.

Affected Products

Microsoft Office (see the Microsoft Security Response Center advisory for the definitive list of impacted builds and channels)
Products relying on the vulnerable Office components for document parsing
Endpoints where users open untrusted Office documents

Discovery Timeline

2026-08-11 - CVE-2026-65664 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-65664

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in Microsoft Office document parsing logic. Office allocates a heap buffer whose size is derived from fields inside a document, then copies content into that buffer without adequate bounds enforcement. When the source data exceeds the allocated capacity, adjacent heap metadata and object pointers are overwritten.

Because the overflow occurs in the heap, attackers can shape memory layout through document structure and embedded objects. Corrupted virtual function tables or freelist pointers redirect execution to attacker-controlled data. The result is arbitrary code execution in the process of the Office application.

Exploitation requires user interaction: the target must open the crafted document. No authentication or network access is required against the vulnerable component. Code runs with the privileges of the user who opened the file.

Root Cause

The root cause is improper validation of a length or count value used during heap allocation and subsequent memory copy. The parser trusts a size field from the document without verifying that the source data matches the allocated buffer. This mismatch is the defining characteristic of [CWE-122] Heap-based Buffer Overflow.

Attack Vector

The attack vector is local. An attacker delivers a weaponized Office document through email, chat, shared drives, or a drive-by download. When the user opens the document, the vulnerable parser processes the malicious structures and triggers the overflow. Preview panes and automatic content loading can broaden the exposure surface.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose because no realCodeExamples were supplied. Refer to the Microsoft Security Update CVE-2026-65664 advisory for vendor technical details.

Detection Methods for CVE-2026-65664

Indicators of Compromise

Office application processes (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE) spawning command interpreters such as cmd.exe, powershell.exe, or wscript.exe
Unexpected child processes writing executables to %APPDATA%, %TEMP%, or %PUBLIC% shortly after a document is opened
Crashes in Office applications with heap corruption signatures in Windows Error Reporting (WER) telemetry
Outbound network connections initiated by Office processes to unfamiliar hosts immediately after document open events

Detection Strategies

Hunt for anomalous parent-child process relationships originating from Office binaries across the fleet
Correlate Office application crashes with subsequent process creation, file write, or persistence activity
Inspect inbound email attachments and shared documents for known-bad hashes and heuristic indicators of malicious Office structures
Apply behavioral analytics to identify script interpreters or LOLBins launched from Office session contexts

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office child processes and executable content creation
Forward Sysmon Event IDs 1 (process create), 3 (network), and 11 (file create) to a central analytics platform
Track Office add-in and macro execution events for unusual patterns
Monitor endpoints for the specific patch level advertised in the MSRC advisory and alert on unpatched hosts

How to Mitigate CVE-2026-65664

Immediate Actions Required

Apply the security updates referenced in the Microsoft Security Update CVE-2026-65664 advisory across all Office installations
Prioritize patching for users who routinely handle externally sourced documents such as finance, legal, HR, and executive assistants
Verify update deployment status through inventory tooling and remediate stragglers
Reinforce user awareness about opening unexpected Office attachments

Patch Information

Microsoft distributes the fix through the standard Microsoft Update, Microsoft 365 update channels, and the Microsoft Update Catalog. Consult the Microsoft Security Update CVE-2026-65664 entry for the exact build numbers per Office version and servicing channel. Deploy through Windows Server Update Services (WSUS), Microsoft Intune, or Configuration Manager based on organizational tooling.

Workarounds

Enable Protected View for files originating from the internet, email attachments, and unsafe locations
Block or restrict macros in Office documents downloaded from the internet using Group Policy
Configure ASR rule Block all Office applications from creating child processes to limit post-exploitation actions
Use email gateway policies to strip or sandbox Office attachments from untrusted senders until patching completes

bash

# Configuration example - Enable ASR rule via PowerShell to block Office child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Enforce Protected View for files from the internet (registry)
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f