The vulnerability is tracked as CWE-125, a class of memory-safety weakness involving an out-of-bounds read. Microsoft describes the issue as follows: “Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.” The stated outcome is information disclosure rather than code execution, data modification, or a service outage, but memory disclosure can reveal material that the affected Office process holds at the time of exploitation.
Microsoft published the advisory on August 21, 2026. Publicly disclosed: No. Exploited: No. Customer action required: Yes. Microsoft’s exploitation assessment is “Exploitation Less Likely,” and its temporal score is 4.8.
A malicious file and Preview Pane can trigger the vulnerable path
CVE-2026-64899 has the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C. In practical terms, the low attack complexity and lack of required attacker privileges do not remove the need for user interaction: Microsoft says an attacker must send a user a malicious Office file and convince them to open it.
The advisory also answers a point that administrators should not overlook when assessing document-handling controls: “Is the Preview Pane an attack vector for this vulnerability? Yes, the Preview Pane is an attack vector.” Teams that treat the Outlook Preview Pane or Explorer preview workflow as a safer alternative to opening a suspicious attachment should not treat that workflow as a mitigation for this CVE.
Microsoft says a successful attacker could potentially read portions of process memory. The advisory does not characterize the specific data that could be exposed beyond that description, so security teams should avoid assuming that this is limited to the contents of the malicious document itself. The risk depends on what the targeted Office process has loaded or is handling when the vulnerable parsing path is reached.
The affected Office coverage spans current and perpetual editions
The affected-product list covers Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and the corresponding listed Mac editions. Both 32-bit and 64-bit Windows installations are included where Microsoft publishes separate editions.
For Microsoft 365 Apps for Enterprise for 32-bit Systems (x86), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later. For Microsoft 365 Apps for Enterprise for 64-bit Systems (x64), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft Office 2016 (32-bit edition) (x86), install KB5002897 to reach fixed build 16.0.5565.1001. For Microsoft Office 2016 (64-bit edition) (x64), install KB5002897 to reach fixed build 16.0.5565.1001. This is the only supplied Windows remediation mapping that provides both a numbered KB and a numeric fixed build, so Office 2016 administrators have a direct compliance target rather than a channel-based release reference.
For Microsoft Office 2019 for 32-bit editions (x86), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later. For Microsoft Office 2019 for 64-bit editions (x64), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft Office LTSC 2021 for 32-bit editions (x86), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later. For Microsoft Office LTSC 2021 for 64-bit editions (x64), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft Office LTSC 2024 for 32-bit editions (x86), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later. For Microsoft Office LTSC 2024 for 64-bit editions (x64), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
Mac deployments have a numeric fixed-build threshold
Microsoft Office 365 for Mac is affected and must be updated to fixed build 16.112.26081010 or later. The same threshold applies to Microsoft Office LTSC for Mac 2021 and Microsoft Office LTSC for Mac 2024.
For Microsoft Office 365 for Mac, update to fixed build 16.112.26081010 or later. For Microsoft Office LTSC for Mac 2021, update to fixed build 16.112.26081010 or later. For Microsoft Office LTSC for Mac 2024, update to fixed build 16.112.26081010 or later.
That explicit version target gives Mac administrators a straightforward inventory check. Systems below 16.112.26081010 remain below Microsoft’s stated fixed version for all three listed Mac product lines.
Patch verification should focus on product edition and update channel
The remediation record divides the affected Office family into two operational paths. Office 2016 uses KB5002897 and build 16.0.5565.1001; Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, and Office LTSC 2024 use the Office security-release fixed-build reference; listed Mac products use build 16.112.26081010.
Administrators should first identify the installed product rather than assuming that an Office update on a Windows endpoint covers every edition in the estate. A managed environment can contain Microsoft 365 Apps for Enterprise alongside perpetual Office 2016, Office 2019, Office LTSC 2021, or Office LTSC 2024 installations, each requiring verification against Microsoft’s applicable remediation path.
The immediate defensive consequence is clear: deploy the applicable Office security update, verify Office 2016 reaches 16.0.5565.1001 through KB5002897 where that edition is installed, and verify listed Mac installations reach 16.112.26081010 or later. Because Microsoft confirms that Preview Pane processing is an attack vector, organizations should prioritize systems whose users routinely receive Office documents through email or shared-file workflows while the update rollout is underway.