CVE-2026-64904

CVE-2026-64904 is a type confusion vulnerability in Microsoft Office carrying a CVSS 7.8 (high severity) but an EPSS of only 0.0031. That gap matters more than it first appears — and it should change how you think about both the vulnerability and your response timeline. Type confusion in Office is not a generic memory safety issue. It occurs at the boundaries where Office's layered architecture collapses — where VBA's late binding meets COM's QueryInterface, where Scripting.Dictionary objects are handed native pointers, where IDispatch calls resolve to objects that don't carry the contract the caller expects. Office's type system isn't a single coherent design; it's decades of accumulated paradigms (native C++, COM interop, .NET layers, VBA scripting) forced to interoperate over file formats that have themselves been revised dozens of times. Type confusion bugs emerge when those seams fracture — typically in code paths that haven't been actively audited in years. The low EPSS likely doesn't reflect inherent exploit difficulty so much as it reflects two things: first, that this code path sits in a forgotten corner of the Office codebase — abandoned DLLs, deprecated subsystems, code paths that survived from earlier versions with no active maintenance. Second, that defenders have hardened the more accessible vectors (macro execution, ActiveX loading, DDE paths) but haven't been auditing these legacy type-resolution boundaries with the same intensity. Attackers optimize for reachability, and this isn't a hot path. But here's what should concern you: once inside WINWORD.EXE through type confusion, the blast radius is wide. You're in the same process that holds your email context, your macro engine, your file save callbacks, and dependent document loading. There's no privilege boundary between the type confusion and these pivot points — exploitation doesn't stop at the parsing layer. For your response: treat this as high severity despite the low EPSS. The EPSS is a temporal snapshot reflecting today's automation difficulty, not a permanent verdict. As proof-of-concept tooling matures and this CVE gets added to scanners, the exploitation probability will rise. Your window to act is now — before that compound interest accrues. Check whether your deployment pipeline can push the Microsoft patch within two weeks of release, because that's where the real exposure lives: not in the vulnerability existing, but in the gap between patch availability and endpoint deployment where orphaned code paths quietly persist.

Reviewed through automated stages and approved by a human before publication.