CVE-2026-66807

Think of this like a flaw in a “picture-handling” part of Office. If someone sends a specially made file, Office can stumble over it and potentially allow harmful code to run on the computer when the file is opened—similar to opening a dangerous document that includes a hidden payload.

This affects common Microsoft Office and Microsoft 365 desktop apps, including Windows Office/Microsoft 365 apps and several Microsoft Office LTSC and Office 365 for Mac editions. It matters most to you if your staff regularly open Office files from email, messaging apps, or external sources (because user interaction is required). The risk is tied to whether the affected Office version is reachable by opening a malicious Office document on the user’s device.

This is being treated as urgent because Microsoft has released fixes and press attention points to active targeting by a major threat actor (Lazarus group). Even without a confirmed publicly available exploit, this type of Office bug is typically delivered through crafted documents, so patching is the practical protection for most small businesses.

1. Inventory what you run

   • Identify every endpoint that has any of the affected products installed: microsoft 365 apps, microsoft 365, office 2019, office 2021, office 2024, office variants listed above, and any Mac equivalents (Microsoft Office 365 for Mac; Microsoft Office LTSC for Mac 2021/2024).
   • Record the exact Office version/build for each device.

2. Check whether you’re already fixed

   • For Microsoft Office for Mac / LTSC for Mac: Microsoft reports the fixed version as 16.112.26081010.
   • For Windows / other listed Microsoft Office editions: use Microsoft’s Office Security Releases and the CVE’s Microsoft update guide to confirm the fixed build for your specific product/branch, because the findings did not provide exact Windows version numbers.

3. Patch (the actual fix)

   • Apply the Microsoft Office security updates as directed by Microsoft:
     • Use https://aka.ms/OfficeSecurityReleases to move the affected Office installs to the fixed builds.
     • Use https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66807 to confirm the correct update path for the specific Office product you have.
   • On Mac devices, ensure the Office build is updated to 16.112.26081010.

4. If patching will be delayed

   • Temporarily reduce exposure by restricting how Office files arrive:
     • Quarantine or block unexpected Office attachments (especially emails from new/unknown senders).
     • Encourage “verify before opening” for external files, and avoid opening macros/attachments from untrusted sources.
   • This does not replace patching, but it lowers the chance someone will open a malicious document.

5. After updating: verify

   • Re-check the Office version/build on each endpoint.
   • Confirm Microsoft Update (or your device management system) is set to install Office security updates.

6. What to monitor

   • Watch for security detections related to Office processes spawning unexpected programs or unusual child processes right after Office is opened.
   • Monitor your email gateway for repeated attempts sending Office attachments that could be using this issue.

CVE-2026-66807 is classified under CWE-121, indicating a stack-based buffer overflow. The vulnerability is in the Microsoft Office Graphics component and can be triggered when processing a crafted document; the provided scoring indicates it requires user interaction (the user must open the file). Based on the findings: there is no KEV entry and no public exploit code on record; exploitation is not confirmed via KEV here. However, press attention notes a patch and an actor connection (Lazarus group), and Microsoft has published fixed versions (including specific Mac build 16.112.26081010). The fix is available via Microsoft’s Office Security Releases and the CVE’s Microsoft security update guide.