CVE-2026-64903

This integer overflow in Microsoft Office affects a legacy file parsing component. While classified as a 'local' attack vector, treat this as a practical RCE pathway — exploitation occurs when targets open malicious documents delivered through phishing or file-sharing, achieving code execution without network proximity. The vulnerability lives in one of Office's oldest, most complex codebases: the file format parsers handling RTF, legacy .doc/.xls binaries, or OLE compound documents. These parsers are functionally abandoned — they work, no one actively maintains them, and they contain arithmetic assumptions from 32-bit eras that have long since rotted. When a size field from an attacker-controlled file wraps during buffer calculation, the resulting heap overflow enables reliable code execution. The blast radius extends far beyond the initial target. Office documents are processed by email servers for preview generation, indexed by SharePoint, scanned by endpoint protection sandboxes, and forwarded through organizational boundaries. If this overflow lives in shared parsing infrastructure — which historical patterns strongly suggest — a single malicious document can cascade through that entire processing chain. Defensive priorities: First, treat all untrusted Office documents as hostile input regardless of source. Second, enforce Attack Surface Reduction rules to block Office from spawning suspicious child processes. Third, ensure your patch deployment cadence for Office is under 30 days — the exploitation window for this vulnerability class routinely compresses into weeks after disclosure, and the historical patch lag of 60-90 days in large organizations creates systematic exposure. Fourth, monitor for anomalous Office child processes and heap spray patterns in Office runtime memory. The EPSS score currently suggests limited active exploitation, but this is a lagging indicator. The genealogical pattern across similar Office parser overflows — from CVE-2012-0158 forward — shows reliable weaponization within disclosure windows. Budget your defensive response accordingly.

Reviewed through automated stages and approved by a human before publication.