CVE-2026-64909

Analyzed Analyzed - Analysis Complete

Integer Underflow in Microsoft Office Leads to Local Code Execution

Publication date: 2026-08-11

Last updated on: 2026-08-14

Assigner: Microsoft Corporation

Description

Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-14

Generated

2026-08-31

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-64909

EUVD

EUVD-2026-56711

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	365_apps	*
microsoft	365_apps	*
microsoft	office_2019	*
microsoft	office_2019	*
microsoft	office_2016	*
microsoft	office_2016	*
microsoft	microsoft_365	*
microsoft	office_2021	*
microsoft	office_2021	*
microsoft	office_2021	*
microsoft	office_2024	*
microsoft	office_2024	*
microsoft	office_2024	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability is an integer underflow issue in Microsoft Office that allows an unauthorized attacker to execute code locally. An integer underflow occurs when a calculation results in a value smaller than the minimum representable integer, causing it to wrap around to a large positive number.

Detection Guidance

This vulnerability involves an integer underflow in Microsoft Office allowing local code execution. Detection requires checking for unusual Office process behavior or known indicators of compromise. Use Microsoft Defender for Office 365 to scan for suspicious activity and review system logs for unexpected Office process launches or memory corruption events.

Impact Analysis

An attacker could exploit this to run malicious code on your system, potentially gaining control over your computer. This could lead to data theft, installation of malware, or further network compromise if you have access to sensitive systems.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and security. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Apply the latest security updates from Microsoft Office immediately to patch the integer underflow vulnerability. Monitor Microsoft's official security advisories for patches and follow their recommended mitigation steps.

Hi! I’m here to help you understand CVE-2026-64909. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70