CVE-2026-64910

This flaw is a “crash-to-code” type of Office bug: when Office reads a malicious document, it can accidentally follow a bad in-memory reference. If the conditions line up, that mistake can be turned into instructions that run on your computer.

Think of it like a document-reader that sometimes misinterprets a sentence and ends up jumping to the wrong part of the book—an attacker may try to use that jump to get the computer to do something they choose.

This matters if your business runs any of these: Microsoft 365 Apps, Microsoft Office, Microsoft 365, Office 2019, Office 2021, Office 2024, or the listed Microsoft Office macOS variants.

Because Microsoft Office file handling is involved, the practical risk is highest when employees receive and open Office documents from untrusted sources. The reachability gate here includes needing access to a vulnerable Office environment and then getting the crafted document to be opened (no confirmed “always on” remote attack is indicated by the findings).

This is a RED issue because it’s a Microsoft Office remote code execution vulnerability affecting common business document software. Even without a confirmed KEV listing or a public exploit on record, Office “open a document” bugs are a common pathway to compromise.

Microsoft has already provided fixed versions, including specific macOS builds, so you can reduce exposure quickly by updating now rather than waiting.