CVE-2026-65661

CVE-2026-65661 is a heap buffer overflow in Microsoft Office with a 7.8 CVSS base score but an EPSS probability of only 0.00332. This divergence should not trigger automatic deprioritization — it should trigger deeper analysis. The low EPSS does not mean this flaw is safe. It means public exploitation research hasn't caught up yet. For a high-value target like Office — sitting at the intersection of enterprise identity, email, document workflows, and cloud sync — sophisticated adversaries build exploits silently rather than publishing proof-of-concepts. The gap between CVSS severity and EPSS probability often reflects the state of public research, not the state of adversary capability. What matters more than the raw scores is the blast radius. A heap overflow in Office isn't a terminal event — it's a pivot point. Code execution here means access to cached credentials, email chains, shared documents, and SSO relationships. The CVSS measures the overflow; the blast radius measures everything downstream. A 7.8 score might be the floor, not the ceiling, of failure. You should also assess code vitality: is this vulnerability in an actively-maintained code path or a dormant one? Heap overflows in mature applications often survive in sediment layers — legacy import filters, deprecated features, backward-compatibility shims that most users never invoke. Dormant defects persist but may have overgrown attack surfaces. Active code paths carry additional risk of new exploitation pathways being introduced during maintenance. Practical guidance: do not deprioritize this solely based on EPSS. Treat the EPSS-CVSS gap as a signal to investigate code vitality and blast radius rather than a signal of safety. For vulnerabilities in high-value targets like Office, the absence of public exploitation proof is not evidence of absence — it's evidence of a research lag that will close. If Microsoft has released a patch, apply it. If the patch timeline is extended, treat the exposure window as time-weighted risk: every day of non-remediation compounds the probability that public exploitation research catches up. Watch for: proof-of-concept publication, incident response discussions referencing this code path, or mentions in attacker tooling. These will signal the EPSS trajectory shifting from dormant to active.

Reviewed through automated stages and approved by a human before publication.