CVE-2026-50467

Microsoft Office has a safety bug that can be abused after a special file is opened. If an attacker sends you that file and a user opens it, it can potentially allow the attacker to run code on the same computer—similar to how a “booby-trapped” attachment could bypass normal protections and install something harmful.

This matters if you use or manage Microsoft Office or Microsoft 365 Apps on any of the listed platforms/editions. It targets Office when a user opens a malicious document, so the risk increases with email phishing and untrusted file sharing.

This is relevant only if the vulnerable Office product/version is installed and a malicious file can be delivered to (and opened by) a user.

Marked RED because this is a remote code execution vulnerability in widely used Microsoft Office products, meaning a successful attack can lead to full compromise of a workstation. A patch is available now, and the flaw’s trigger involves opening attacker-controlled files, which commonly happens through everyday business email and downloads.