CVE-2026-64910

This flaw is a “crash-to-code” type of Office bug: when Office reads a malicious document, it can accidentally follow a bad in-memory reference. If the conditions line up, that mistake can be turned into instructions that run on your computer.

Think of it like a document-reader that sometimes misinterprets a sentence and ends up jumping to the wrong part of the book—an attacker may try to use that jump to get the computer to do something they choose.

This matters if your business runs any of these: Microsoft 365 Apps, Microsoft Office, Microsoft 365, Office 2019, Office 2021, Office 2024, or the listed Microsoft Office macOS variants.

Because Microsoft Office file handling is involved, the practical risk is highest when employees receive and open Office documents from untrusted sources. The reachability gate here includes needing access to a vulnerable Office environment and then getting the crafted document to be opened (no confirmed “always on” remote attack is indicated by the findings).

This is a RED issue because it’s a Microsoft Office remote code execution vulnerability affecting common business document software. Even without a confirmed KEV listing or a public exploit on record, Office “open a document” bugs are a common pathway to compromise.

Microsoft has already provided fixed versions, including specific macOS builds, so you can reduce exposure quickly by updating now rather than waiting.

Confirm whether you’re exposed

1. Identify where the affected Office apps are installed:
   • Windows: Microsoft 365 Apps and Microsoft Office (also applies to Office 2019/2021/2024 per the affected list).
   • macOS: Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024.
2. For each device, check the installed Office build/version:
   • macOS: in any Office app, use the app’s “About” / version screen to read the build number.
   • Windows: use Office’s version/about page (or your admin tooling) to capture the build.

Apply the fixed versions

1. macOS (explicit fixed build from Microsoft):
   • Update Microsoft Office 365 for Mac to 16.112.26081010 or later.
   • Update Microsoft Office LTSC for Mac 2021 to 16.112.26081010 or later.
   • Update Microsoft Office LTSC for Mac 2024 to 16.112.26081010 or later.
2. Windows / other impacted Microsoft Office products:
   • Follow Microsoft’s Office security release guidance for CVE-2026-64910 (Microsoft’s Office security releases link and the CVE-2026-64910 update guide).
   • Ensure the update actually completes and that the Office “About” version/build reflects the patched level.

If you can’t patch immediately

1. Reduce the chance of exposure in the meantime by treating incoming Office attachments from outside your organization as untrusted until patched.
2. Prioritize updating the machines that most often receive external documents (email gateway exceptions, shared inboxes, or receptionist/admin accounts).

What to monitor after patching

1. Confirm Office updates continue to apply as scheduled (so systems don’t drift back).
2. Watch for any suspicious endpoint activity on devices that were not updated yet (especially around the time an external document was opened), and then complete patching without delay.

KEV/CISA note

• CVE-2026-64910 is not listed in the CISA KEV findings provided with this request, and there is no public exploit code on record in the provided findings.

Summary

• CVE: CVE-2026-64910
• Affected products (as provided): microsoft 365 apps, microsoft office, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, microsoft 365, office 2019, office 2021, office 2024.
• Weakness: CWE-822 (Untrusted pointer dereference).

Mechanism and triggering

• The findings describe Microsoft Office as allowing code execution when processing an untrusted input that leads to an untrusted pointer dereference.
• The provided CVSS vector indicates user interaction is required (UI:R) and the attack path is not purely network-reachable without involving a user opening/handling something.

Exploitation status

• The provided findings state: no public exploit code on record.
• The provided findings also state: CVE-2026-64910 is not listed in the CISA KEV dataset.
• Press attention is noted (patch-related) and an actor name is mentioned (“Lazarus group”) in the findings; however, the findings do not provide proof of exploitation.

Fix information

• macOS fixed in: 16.112.26081010 for Microsoft Office 365 for Mac and both Office LTSC for Mac 2021/2024.
• Windows/other Microsoft Office products are addressed via Microsoft’s Office security releases and the update guide for CVE-2026-64910 (links provided in the findings).

EPSS

• EPSS is provided as a prediction in the findings (flat trend). Per the instructions, the prediction value is not reproduced in the public-facing owner blocks.