CVE-2026-65664

This vulnerability is in how Microsoft Office handles certain graphics content. If someone sends you an Office file with a specially crafted “graphics” part and you open it, the bug can let code run on your computer. Think of it like a “malicious picture inside a document” that Office fails to safely process.

This matters if your business uses Microsoft 365 Apps, Microsoft Office (Office 2019/2021/2024), or any of the listed Microsoft Office for Mac / LTSC for Mac versions. It’s a risk when an attacker can get you to open a malicious Office file (it requires user interaction like opening the file). It’s not a general background vulnerability that triggers just by having Office installed.

This should be treated as urgent because attackers have shown interest (Lazarus group referenced in the reporting) and Office vulnerabilities can be quickly weaponized through email attachments. Your fastest protection is to apply the vendor’s fixed releases now, since a user opening a malicious file is enough to trigger the problem. The current tracking does not list this in the CISA KEV set, but that does not reduce the need to patch.