CVE-2026-64898

This is a Microsoft Office weakness where a bad file can cause Office to behave in an unsafe way. If an attacker sends you a crafted document and someone opens it, Office could run attacker-controlled code on the device—like turning a normal document into a launch point for malware.

This matters if your business uses Microsoft 365 Apps, Microsoft Office (including Microsoft Office 365 for Mac and the listed Office LTSC for Mac versions), or Office 2019/2021/2024 on workstations or other endpoints. It becomes a risk when an attacker can get a user to open a malicious Office document in your environment. The attack does not require you to have previously installed anything unsafe—your exposure is driven by having the vulnerable Office version and the ability for attackers to deliver a crafted file to your users.

This is a RED issue because Microsoft has released fixes and the vulnerability involves remote code execution triggered by opening a malicious Office document. In practice, Office document–based attacks are a common route for attackers, and press attention indicates active focus on this topic. Act immediately to get all affected Office installs updated to the fixed versions.