CVE-2026-64907

Think of Microsoft Word as a document reader. This vulnerability is like a “crash-and-run” bug: with a specially crafted document, an attacker may be able to get Word to run code on your computer when a person opens the file—turning a document into an attack delivery method.

This matters if your business uses Microsoft Word as part of Microsoft 365 apps, Microsoft Office (including Office 2019/2021/2024), or Microsoft Office for Mac / Office LTSC for Mac. Because the attack requires someone to open a crafted document, the main risk is phishing or targeted emails that trick staff into opening the file. Act as if you’re exposed if you have affected Office/Word installed and users can receive external documents (the document must be opened to trigger the issue).

This is marked RED because the underlying issue is serious (remote code execution) and Microsoft has already issued a patch, alongside reporting that an advanced actor (Lazarus group) is associated with the activity driving attention. Even though there’s no public exploit code on record and no CISA KEV listing, your best protection is to update promptly to the fixed Office releases listed by Microsoft.