CVE-2026-66807
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Risk Assessment
An attacker could gain control of the system if a user opens a malicious file.
Recommendation
Install the latest security updates for Microsoft Office.
Other vulnerabilities in Microsoft Office
See all- CVE-2026-26134High
Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally.
- CVE-2026-26110High
Microsoft Office has a vulnerability related to resource access using an incompatible type ('type confusion'), allowing an unauthorized attacker to execute code locally.
- CVE-2026-20953High
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2026-20952High
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2026-20943High
An untrusted search path vulnerability in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2025-53732High
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2025-49702High
A vulnerability in Microsoft Office related to access of resource using incompatible type ('type confusion') allows an unauthorized attacker to execute code locally.
- CVE-2025-49697High
A heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2025-49696High
An out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
- CVE-2025-49695High
A use after free vulnerability in Microsoft Office allows an unauthorized attacker to execute code locally.
Original NVD description (English source)
Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS