CVE-2026-64909

This vulnerability is a weakness in Microsoft Office where a specially crafted document can cause Office to behave incorrectly—and that mistake can be turned into running malicious code on the computer. Think of it like a “poisoned” form that doesn’t just crash the app; it can lead the app to hand control of the computer to an attacker when the form is opened.

This matters if your business uses Microsoft Office (including Microsoft 365 apps and Office 2016/2019/2021/2024) on Windows or macOS, especially if employees receive and open documents from email or the internet. The risk is tied to user action: you’re exposed only if an attacker can get you to open a crafted file in Office; there’s no need for the attacker to already have an account.

This is RED because the issue is capable of arbitrary code execution on the user’s machine after opening a crafted Office file, which makes it practical for targeted attacks. While no specific public incident tied to this exact CVE was found in the provided reports, the reporting indicates active actor attention (notably Lazarus group) and a newly released patch, so you should act now.