CVE-2026-65664

This CVE presents a genuine tension between its CVSS 7.8 rating and an EPSS score of 0.00359 that deserves direct attention in your triage workflow. The 'local' attack vector is the culprit — it creates semantic ambiguity that obscures the actual threat profile. The critical distinction: 'local' describes where code execution occurs, not how the attacker delivers the weaponized payload. This vulnerability triggers on document opening — typically via email, web download, or shared files. These are network-mediated delivery mechanisms, even though the technical classification marks the execution context as 'local.' The practical attack chain looks like this: attacker delivers malicious document → victim opens it → heap overflow triggers → attacker achieves code execution. That's an initial access vector in practice, regardless of how the CVE is classified. Your triage should account for three factors the CVSS score alone obscures. First, privilege scope: the CVE doesn't clarify whether execution is limited to the current user context or enables escalation. Same-user impact and SYSTEM-level compromise are meaningfully different risk profiles. Second, post-exploitation reach: a compromised workstation running Microsoft Office almost certainly accesses email, internal documents, and often VPN tunnels. The blast radius isn't in the trigger mechanism — it's in what happens after successful exploitation. An attacker with persistence on a knowledge worker's machine has pivoted from 'local code execution' to 'domain-joined endpoint with user access rights.' Third, code decay: document parsing components are notorious for atrophying over time. Teams move on, security tests get removed for build speed, and legacy parsing code becomes sediment — technically reachable but practically forgotten. The EPSS captures wild exploitation probability today; it says nothing about how that probability curves upward as the surrounding code ages and maintenance attention lapses. The scoring ecosystem itself may be working against accurate prioritization. EPSS trains on historical CVE data, which systematically underweights 'local' classified vulnerabilities that function as initial access vectors. This creates a feedback loop where the classification artifact becomes self-confirming evidence that 'local' CVEs are lower priority — exactly the category threat actors actively exploit. For practical action: prioritize patching document parsing components despite the low EPSS score, implement email gateway detection for weaponized attachments targeting Office parsers, and treat the 'local' designation as a signal to investigate attack chain position rather than a reason to deprioritize. The credible threat model is email-delivered malicious document achieving initial access, not an attacker who somehow already has local code execution and needs this as a secondary step.

Reviewed through automated stages and approved by a human before publication.