Heap-based buffer overflow in Microsoft Office

CVE-2026-65664 is a heap-based buffer overflow in the Microsoft Office Graphics Component, the shared rendering library responsible for processing embedded images and graphical objects across Word, Excel, PowerPoint, and Outlook. Exploitation requires a user to open a specially crafted Office document; the Preview Pane is explicitly not an attack vector. Successful exploitation yields arbitrary code execution in the context of the current user. Affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 across Windows and macOS — essentially every managed Office installation in a typical enterprise.

Microsoft rates this HIGH at CVSS 7.8, but the vendor's own exploitability assessment says *"exploitation less likely."* That's the right instinct. The CVSS score captures the theoretical ceiling — full CIA impact with low complexity — but it doesn't account for the layered real-world friction: Protected View sandboxes all externally-sourced documents, Attack Surface Reduction (ASR) rules block Office child-process spawning, and every major email gateway detonates Office attachments before delivery. With no public proof-of-concept, no wild exploitation, and an EPSS of 0.36%, the operational risk today is meaningfully lower than the label suggests. This is a downgrade to MEDIUM.

Why this verdict

• No PoC, no exploitation, vendor concurs: Microsoft explicitly marks this as *exploitation less likely*, EPSS is 0.36%, and no researcher has published a working trigger. The vulnerability is two days old with zero attacker interest.
• Protected View breaks the chain for most delivery paths: Every externally sourced Office document opens in a restricted sandbox. The attacker needs the user to explicitly click *Enable Editing* — a second gate beyond just opening the file. This friction point is not captured in the CVSS vector's UI:R metric.
• ASR rules and EDR neutralize post-exploitation: Even if the overflow fires, the standard enterprise ASR rule blocking Office child processes (enabled by default in Defender for Endpoint) prevents the attacker from spawning cmd.exe, powershell.exe, or any useful payload. EDR agents independently detect anomalous Office behavior.
• Role multiplier: Office Graphics Component runs on endpoints (workstations, laptops). It is not a canonical high-value-role component — it is not a domain controller, hypervisor, identity provider, backup server, or network edge appliance. Successful exploitation compromises a single user session on a single workstation in user context (not SYSTEM). The blast radius is host-local, user-context only. No floor override applies.

Why not higher?

There is no evidence this vulnerability is being exploited or that a reliable exploit exists. Microsoft's own assessment is *exploitation less likely*. The EPSS score of 0.36% places it in the bottom quartile of all scored CVEs. Upgrading to HIGH would require at minimum a credible PoC, active scanning, or a bypass of Protected View — none of which exist today.

Why not lower?

Office heap overflows in the Graphics Component are a historically targeted vulnerability class — similar bugs (e.g., CVE-2025-60724) have been weaponized in the past. The affected population is enormous (every enterprise running Microsoft 365 Apps), and the theoretical impact is full user-context RCE. Dropping to LOW would undercount the latent risk if a PoC emerges.

1. Enforce ASR rule: Block Office apps from creating child processes — Rule GUID D4F940AB-401B-4EFC-AADC-AD5F3C50688A in Block mode prevents the most impactful post-exploitation actions even if the heap overflow succeeds. Verify enforcement via Intune or GPO. No mitigation SLA applies at MEDIUM — this is defense-in-depth you should already have.
2. Ensure Protected View is enabled and MOTW is not stripped — Confirm via GPO/Intune that Protected View is active for files from the Internet, Outlook attachments, and unsafe locations. Audit for third-party tools (e.g., 7-Zip versions before 24.09) that strip MOTW on extraction, which would bypass Protected View.
3. Enable Safe Attachments in Defender for Office 365 — Dynamic detonation of Office attachments in a sandbox before delivery to the mailbox. This catches weaponized documents before they reach the user. If not using Defender for O365, ensure your email gateway has equivalent sandboxing.
4. Deploy Application Guard for Office where feasible — Renders untrusted Office documents in a Hyper-V isolated container, preventing any exploit from touching the host. Most effective for high-risk users (executives, finance, HR).

Run on each target Windows host with the Office installation you want to check. Execute in an elevated PowerShell session. Example: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-65664.ps1. Requires read access to the Office installation directory and registry.

#Requires -Version 5.1
<# Check-CVE-2026-65664.ps1
   Checks whether the August 2026 Office security update is installed.
   Outputs: VULNERABLE / PATCHED / UNKNOWN
   Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'

# August 2026 Patch Tuesday release date
$patchDate = [datetime]'2026-08-11'

try {
    # Check for Click-to-Run Office (Microsoft 365 / Office LTSC)
    $c2rKey = 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration'
    if (Test-Path $c2rKey) {
        $versionStr = (Get-ItemProperty -Path $c2rKey -Name 'VersionToReport' -ErrorAction SilentlyContinue).VersionToReport
        $updateDate = (Get-ItemProperty -Path $c2rKey -Name 'UpdateDetectionLastRunTime' -ErrorAction SilentlyContinue).UpdateDetectionLastRunTime

        if ($versionStr) {
            Write-Host "Office Click-to-Run version: $versionStr"
            # Parse build number (major.minor.build.rev)
            $parts = $versionStr -split '\.'
            $build = [int]$parts[2]
            $rev   = [int]$parts[3]

            # August 2026 Current Channel builds are typically 16.0.xxxxx.yyyyy
            # where build >= August 2026 release build
            # Check if the last update detection was after patch Tuesday
            if ($updateDate) {
                $lastUpdate = [datetime]::Parse($updateDate)
                if ($lastUpdate -ge $patchDate) {
                    Write-Host "PATCHED - Office updated after $($patchDate.ToString('yyyy-MM-dd')). Last update check: $($lastUpdate.ToString('yyyy-MM-dd'))"
                    exit 0
                }
            }

            # Fallback: check Windows Update history for Office updates
            $session = New-Object -ComObject Microsoft.Update.Session
            $searcher = $session.CreateUpdateSearcher()
            $historyCount = $searcher.GetTotalHistoryCount()
            $history = $searcher.QueryHistory(0, $historyCount)
            $officeUpdates = $history | Where-Object {
                $_.Title -match 'Office' -and $_.Date -ge $patchDate
            }

            if ($officeUpdates) {
                Write-Host "PATCHED - Found Office update(s) installed after $($patchDate.ToString('yyyy-MM-dd')):"
                $officeUpdates | ForEach-Object { Write-Host "  $($_.Date.ToString('yyyy-MM-dd')): $($_.Title)" }
                exit 0
            } else {
                Write-Host "VULNERABLE - No Office updates found after $($patchDate.ToString('yyyy-MM-dd')). Current build: $versionStr"
                exit 1
            }
        }
    }

    # Check for MSI-based Office (older installs)
    $msiKeys = @(
        'HKLM:\SOFTWARE\Microsoft\Office\16.0\Common\ProductVersion',
        'HKLM:\SOFTWARE\Microsoft\Office\15.0\Common\ProductVersion'
    )
    foreach ($key in $msiKeys) {
        if (Test-Path $key) {
            Write-Host "MSI-based Office detected at $key"
            Write-Host "UNKNOWN - MSI Office detected. Manually verify KB installation via 'wmic qfe' or WSUS."
            exit 2
        }
    }

    Write-Host "UNKNOWN - Microsoft Office installation not detected on this host."
    exit 2
} catch {
    Write-Host "UNKNOWN - Error during check: $($_.Exception.Message)"
    exit 2
}

Sources

1. Cisco Talos - Microsoft Patch Tuesday August 2026
2. CrowdStrike - Patch Tuesday Analysis August 2026
3. Cyber Security News - Microsoft Patch Tuesday August 2026
4. Senserva - August 2026 Patch Tuesday CVE Rankings
5. MSRC Security Update Guide
6. CISA Known Exploited Vulnerabilities Catalog
7. GitHub Advisory - CVE-2025-60724 (prior Office Graphics Component overflow)