Microsoft has released fixes for CVE-2026-64903, Microsoft Office Remote Code Execution Vulnerability, a Critical Microsoft Office flaw that can allow an unauthorized attacker to execute code locally through integer overflow or wraparound. The update covers Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, Microsoft Office 365 for Mac, and the Mac editions of Office LTSC.

Microsoft’s advisory assigns CVE-2026-64903 a CVSS base score of 7.8 and a temporal score of 6.8. The full vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C. Microsoft lists CWE-122 and CWE-190 as the applicable weakness categories.

The immediate administrative task is to make sure Office clients have received the relevant security update. Office 2016 is mapped to a named KB and fixed build, while the current servicing products are directed to their respective Office security-release build paths. Mac installations have a specific minimum fixed build: 16.112.26081010.

Abstract illustration of connected devices separated by a protected security boundary.A local attack path with a remote attacker​

Microsoft describes the issue as follows: “Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.” The CVSS vector rates the attack vector as local, AV:L, but Microsoft specifically explains why the advisory uses “Remote Code Execution” in its title: Remote describes the attacker’s location, while the exploit itself is carried out locally. Microsoft says this class of issue can also be called Arbitrary Code Execution, or ACE.

The difference is operationally important. This is not described as a network service vulnerability that an attacker can trigger merely by reaching an exposed Office-related port. Instead, the attack requires content to be processed on the local machine. The CVSS vector also specifies UI:R, meaning user interaction is required.

According to Microsoft’s advisory, an attacker must send a user a malicious Office file and convince them to open it. That makes phishing-resistant document handling, attachment screening, and timely Office patching relevant controls, but they do not replace the vendor’s update. The vulnerability’s confidentiality, integrity, and availability impacts are all rated High in the CVSS vector.

Microsoft also explicitly identifies the Preview Pane as an attack vector. Administrators should therefore not treat an Office file as harmless solely because a user has not deliberately opened it in a full editing window; the advisory says Preview Pane processing can provide the relevant attack path.

Microsoft’s risk assessment​

Microsoft rates CVE-2026-64903 as Critical. Its 7.8 CVSS base score reflects an attack requiring neither privileges nor complex conditions, while still requiring user interaction and local processing. The score should not be read as evidence of a drive-by network compromise, because Microsoft’s own advisory is clear that a malicious Office file must reach the victim and be opened.

Publicly disclosed: No

Exploited: No

Customer action required: Yes

Microsoft’s exploitation assessment is “Exploitation Less Likely.” That assessment describes Microsoft’s current judgment about the vulnerability’s likelihood of exploitation; it does not remove the need to deploy the fixes on affected clients, particularly where Office documents arrive from outside the organization.

The advisory’s combination of a Critical severity rating, no required attacker privileges, and a Preview Pane attack vector means patch prioritization should focus on endpoints that routinely handle externally supplied Office files. That includes conventional user workstations, shared document-processing systems, and Macs managed alongside Windows Office deployments.

Windows Office fixes and KB5002897​

For Microsoft Office 2016, Microsoft provides an explicit KB-to-build mapping for both architectures. The required update is KB5002897, which brings the affected editions to fixed build 16.0.5565.1001.

  • For Microsoft Office 2016 (32-bit edition) (x86), install KB5002897 to reach fixed build 16.0.5565.1001.
  • For Microsoft Office 2016 (64-bit edition) (x64), install KB5002897 to reach fixed build 16.0.5565.1001.

The affected perpetual and subscription-based Windows Office families use Microsoft’s Office security-release build path rather than a CVE-specific KB number in the advisory’s affected-product record. Administrators should use the build information indicated by Microsoft’s Office security update documentation for their deployed servicing configuration.

This distinction is worth preserving in deployment records. KB5002897 and build 16.0.5565.1001 are the stated remediation for Office 2016, while the Microsoft 365 Apps, Office 2019, and Office LTSC Windows products are remediated by reaching the applicable Office security-release fixed build or later.

Mac fixed build: 16.112.26081010​

Microsoft’s affected-product data sets a specific minimum fixed version for each listed Mac product: 16.112.26081010. Organizations that manage Microsoft Office across Windows and macOS should account for this separate version target rather than using the Office 2016 KB mapping for Mac endpoints.

  • For Microsoft Office 365 for Mac, update to fixed build 16.112.26081010 or later.
  • For Microsoft Office LTSC for Mac 2021, update to fixed build 16.112.26081010 or later.
  • For Microsoft Office LTSC for Mac 2024, update to fixed build 16.112.26081010 or later.

The remediation record divides the estate cleanly: Office 2016 administrators can validate KB5002897 and build 16.0.5565.1001; Mac administrators can validate build 16.112.26081010; and teams maintaining Microsoft 365 Apps, Office 2019, and Office LTSC for Windows must confirm that their update servicing has reached the security-release fixed build specified by Microsoft.

What to verify after deployment​

Microsoft’s advisory establishes that this is a document-delivered local code-execution issue, with user interaction required and Preview Pane exposure included. Patch verification should therefore be tied to the installed Office product and architecture, not inferred from the Windows version or from the presence of a general operating-system cumulative update.

For Microsoft 365 Apps for Enterprise for 32-bit Systems (x86) and Microsoft 365 Apps for Enterprise for 64-bit Systems (x64), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later. For Microsoft Office 2019 for 32-bit editions (x86), Microsoft Office 2019 for 64-bit editions (x64), Microsoft Office LTSC 2021 for 32-bit editions (x86), Microsoft Office LTSC 2021 for 64-bit editions (x64), Microsoft Office LTSC 2024 for 32-bit editions (x86), and Microsoft Office LTSC 2024 for 64-bit editions (x64), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.

For Microsoft Office 2016 (32-bit edition) (x86) and Microsoft Office 2016 (64-bit edition) (x64), install KB5002897 to reach fixed build 16.0.5565.1001. For Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024, update to fixed build 16.112.26081010 or later.

CVE-2026-64903 was published on August 21, 2026. Microsoft has marked customer action as required, and the practical remediation milestone is straightforward: verify every affected Office installation has reached its stated fixed build, with particular attention to endpoints that process Office attachments or previews from untrusted senders.

 

Click to expand...
You must log in or register to reply here.