CVE-2026-65657 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office deployments, especially those with local access to Office applications, should assess exposure and prioritize patching.

Why it matters

CVE-2026-65657 is a high-severity vulnerability in Microsoft Office that allows local code execution. Defenders should prioritize patching affected versions and monitor for suspicious activity.

• Local code execution is possible due to the use-after-free vulnerability
• Patching vulnerable versions is crucial to prevent exploitation
• Inventory and updates are necessary for Microsoft 365 Apps for Enterprise, Office 2019, Office 365 for Mac, and LTSC versions
• Monitoring for suspicious local activity is advised

Technical summary

The vulnerability is a use-after-free issue in Microsoft Office, allowing an unauthorized attacker to execute code locally. Multiple products are affected, including Microsoft 365 Apps for Enterprise, Office 2019, Office 365 for Mac, and various LTSC versions.

Defensive priority

Defenders should prioritize patching vulnerable Microsoft Office versions, especially for users with local access.

Recommended defensive actions

• Patch vulnerable Microsoft Office versions
• Inventory and update Microsoft 365 Apps for Enterprise, Office 2019, Office 365 for Mac, and LTSC versions
• Monitor for suspicious local activity

Evidence notes

The vulnerability exists in multiple Microsoft Office products, including Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office 365 for Mac, and various LTSC versions. Affected versions require patching to prevent local code execution.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.