CVE-2026-64903

Think of Microsoft Office like the “engine” that reads documents. This bug is a flaw in how the engine handles a certain kind of document data, which can let a bad document turn into running code on your computer. In real terms, it’s the kind of issue where opening a carefully made file can lead to malware being installed.

This matters if your business uses Microsoft Office on Windows or Mac, especially if employees open emails or documents from outside your company. The risk is tied to interaction with a malicious Office file, so it’s most relevant where phishing or untrusted attachments are possible. The vulnerability is not described as automatic—there must be a user-triggered interaction (for example, opening a malicious document).

Verdict: RED. Even though there is no public exploit code on record and no KEV listing, the bug is being actively tracked and Microsoft has released fixes, and press coverage points to active interest by a major threat actor. Treat this as an urgent patching item for any organization that receives external emails and documents.