CVE-2026-64918: Microsoft Office Spoofing Vulnerability
Overview
- Severity
- Medium (CVSS 6.5)
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
- Category
- Spoofing
- Exploit Status
- Not Exploited
- Exploitation Likelihood
- Less Likely
- Patch Tuesday
- 2026-Sep
- Released
- 2026-09-08
Description
Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network.
FAQ
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
A user interacting with the file in multiple ways will cause the NTLM hash to be leaked. A few interactions which trigger this leak include:
Opening the parent folder in Explorer
Clicking the file (any mouse button)
Dragging the file
Deleting the file
Affected Products (10)
Microsoft Office
- Microsoft Office 2019 for 32-bit editions
- Microsoft Office 2019 for 64-bit editions
- Microsoft 365 Apps for Enterprise for 32-bit Systems
- Microsoft 365 Apps for Enterprise for 64-bit Systems
- Microsoft Office LTSC 2021 for 64-bit editions
- Microsoft Office LTSC 2021 for 32-bit editions
- Microsoft Office LTSC 2024 for 32-bit editions
- Microsoft Office LTSC 2024 for 64-bit editions
- Microsoft Office 2016 (32-bit edition)
- Microsoft Office 2016 (64-bit edition)
Acknowledgments
yhw & txz
Revision History
- 2026-09-08: Information published.