{"id":404548,"date":"2026-08-22T02:50:43","date_gmt":"2026-08-22T02:50:43","guid":{"rendered":"https:\/\/malwaretips.com\/blogs\/?p=404548"},"modified":"2026-08-22T04:02:22","modified_gmt":"2026-08-22T04:02:22","slug":"office-2607-update","status":"publish","type":"post","link":"https:\/\/malwaretips.com\/blogs\/office-2607-update\/","title":{"rendered":"A Word file can own the PC. Update Office to 2607"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Office is how a file from email becomes a document on the PC. Microsoft&#8217;s 11 August security update for Microsoft 365 Apps closes a pile of Word and Office remote-code bugs. You do not need Windows Update for this one. Word has its own updater: File, Account, Update Now. Current Channel should read Version 2607, Build 20228.20190.<\/p><div id=\"mwtad2053572647\" class=\"gas_fallback-ad_309684--placement_400588\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3957935887\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1536\" height=\"1024\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-office-overview.png\" alt=\"Word document in Protected View next to Outlook\" class=\"wp-image-404580\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-office-overview.png 1536w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-office-overview-300x200.png 300w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-office-overview-1024x683.png 1024w\" sizes=\"auto, (max-width: 1536px) 100vw, 1536px\" \/><figcaption class=\"wp-element-caption\">A file can own the machine.<\/figcaption><\/figure>\n\n\n\n<div id=\"mwtad1868835962\" class=\"gas_fallback-ad_309747-ad_309691-placement_400589\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"9589536513\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Overview<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What broke<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">On 11 August 2026 Microsoft published the monthly Office security notes. Word alone lists more than a dozen CVEs. One you can hang the story on is <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2026-64907\" target=\"_blank\" rel=\"noopener\">CVE-2026-64907<\/a>: a stack-based buffer overflow in Word. In English, a crafted document can write past a fixed buffer and run code as you. A crafted document typically needs to be opened. Microsoft has not flagged these Office CVEs as exploited. CISA has not put 64907 on KEV.<\/p>\n\n\n\n<div id=\"mwtad4176301156\" class=\"mwtadp1 mwtadentity-placement\" style=\"margin-top: 50px;margin-bottom: 50px;\"> \r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block; text-align:center;\"\r\n     data-ad-layout=\"in-article\"\r\n     data-ad-format=\"fluid\"\r\n     data-ad-client=\"ca-pub-7750719144850257\"\r\n     data-ad-slot=\"7312657698\"><\/ins>\r\n <\/div><p class=\"wp-block-paragraph\">A stack overflow is the tight cousin of a heap overflow. Word puts a small, fixed shelf of memory aside (the stack) while it parses the file. A crafted document hands it more than the shelf can hold. The extra bytes overwrite the return address, the &#8220;where do I go next&#8221; note. Next is the attacker&#8217;s code, running as you, with your files and your Outlook already unlocked. That is remote code execution in a Word file.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The same day also patches Excel, Outlook, PowerPoint, and the Office suite. The <a href=\"https:\/\/learn.microsoft.com\/en-us\/OfficeUpdates\/microsoft365-apps-security-updates\" target=\"_blank\" rel=\"noopener\">Office security updates notes<\/a> for 11 August list the CVE pile under each app. One Update Now covers the set. Do not cherry-pick Word. A shop that only &#8220;uses Excel&#8221; still has the Word parser on the disk.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Who is in range<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft 365 Apps, the Word, Excel, and Outlook you rent monthly, plus Office 2024 and Office 2021 retail, plus the volume LTSC builds Microsoft listed for 11 August. Home and the shop both run this. A PC that only took Windows Update is not done. Office updates separately unless the shop image forces both. Office on the web, in the browser, is a different product and a different updater.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Office 2019 is out of support as of 14 October 2025. Microsoft may still ship a volume build at its discretion. That is not a product you should keep. If File, Account still shows Office 2019, the security story is larger than this month&#8217;s CVE list.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A home Microsoft 365 subscription and a shop volume license both land on File, Account. The channel name changes. The click does not. If you have Word on a home laptop and Outlook on a shop desktop, those are two Click-to-Run installs. Update Now on one does not push bits to the other. Treat each PC as its own close.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What the vendor shipped<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">From the 11 August 2026 section of the Office notes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Current Channel and Office 2024 \/ 2021 retail: Version 2607, Build 20228.20190<\/li>\n<li>Monthly Enterprise Channel 2607: Build 20228.20188<\/li>\n<li>Office LTSC 2024: Version 2408, Build 17932.20910<\/li>\n<li>Office LTSC 2021: Version 2108, Build 14334.20848<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The in-app path is Word, File, Account, Update Options, Update Now. Excel or Outlook will do the same job. One Click-to-Run updater serves the suite. Shops on Monthly Enterprise should confirm 20228.20188, not the retail 20190, if that is the channel the image is pinned to.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What this is not<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Not a Windows Update. Checking for Windows patches does not replace File, Account, Update Now.<\/li>\n<li>Not a Preview Pane claim. A crafted document typically needs to be opened. Do not add a preview-only story on top of the notes.<\/li>\n<li>Not flagged as exploited. Microsoft did not mark these August Office CVEs that way. They are not on KEV.<\/li>\n<li>Not a Word-only patch. Excel, Outlook, PowerPoint, and the suite share the same Update Now.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The build is sitting behind Update Now. That is the cheap window. You do not need a full Office reinstall, and you do not need Windows Update for this specific close. Stay on the Account page until the version line changes. If Word restarts itself, that is the updater finishing, not a crash.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1536\" height=\"1024\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-office-hero-1.png\" alt=\"Do This Now card: Update Office, in range You plus the shop, urgency Today, then File Account Update Now\" class=\"wp-image-404557\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-office-hero-1.png 1536w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-office-hero-1-300x200.png 300w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-office-hero-1-1024x683.png 1024w\" sizes=\"auto, (max-width: 1536px) 100vw, 1536px\" \/><figcaption class=\"wp-element-caption\">File, Account, Update Now.<\/figcaption><\/figure>\n\n\n\n<div id=\"mwtad2840744909\" class=\"gas_fallback-ad_309748-ad_309691-placement_400590\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3906789406\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Do This Now<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>In range:<\/strong> You, plus the shop. Microsoft 365 Apps or Office 2021 \/ 2024 that have not taken the 11 August build.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Urgency:<\/strong> Today. A document is the attack. The updater is inside Word.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open Word. File, Account. Under Product Information, Update Options, Update Now.<\/li>\n<li>When it finishes, File, Account again. Current Channel should show Version 2607 (Build 20228.20190) or a later 2607 build.<\/li>\n<li>Repeat on the shop PCs that run Outlook or Excel. One stale Office is enough.<\/li>\n<\/ol>\n\n\n\n<div id=\"mwtad4278597288\" class=\"gas_fallback-ad_309749-ad_309691-placement_400591\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"5354318971\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Who can skip<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>File, Account already shows Version 2607, Build 20228.20190 or newer (or the LTSC build in the list above).<\/li>\n<li>Google Docs or LibreOffice only, and you never open Word files in Microsoft Word, skip.<\/li>\n<li>Office on the web only, in the browser, skip this updater. Take the browser brief instead.<\/li>\n<li>A shop image that already pushed 2607 through its own Click-to-Run channel can skip the manual click. Confirm the build number anyway.<\/li>\n<\/ul>\n\n\n\n<div id=\"mwtad616823028\" class=\"gas_fallback-ad_309750-ad_309691-placement_400592\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"4041237300\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Why it matters<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Email is a delivery system for Word files. &#8220;Please see attached&#8221; is how these bugs get a click. The file looks like a quote, a resume, a school notice, a supplier invoice. You open it because that is what Word is for. On the old build, opening it is the hole.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft did not say these August Office CVEs are in the wild. The notes are public and the build is sitting behind Update Now. That is the honest status. Waiting is how a stack overflow in Word becomes a story with a name on the invoice. Shops have a second habit that makes this worse: they let Windows Update run and assume Office came along. It does not. The suite has its own Click-to-Run engine. File, Account is the proof.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The shop front desk, the laptop that only opens Outlook, the PC in the back that still has a decade of .docx files: those are all in range if they still launch Word. One Update Now each. One stale client is enough to keep the old parser alive. A shared mailbox does not patch the client. The build on the PC that opens the attachment is the build that matters.<\/p>\n\n\n\n<div id=\"mwtad1754443908\" class=\"gas_fallback-ad_309751-ad_309691-placement_400593\" style=\"margin-top: 50px;margin-bottom: 50px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3690286463\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">The bottom line<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Update Word (this also updates Excel and Outlook)<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open Word. Any blank document is fine. You do not need to open the suspicious file first. Close it if you already did, then update before you open it again.<\/li>\n<li>Click File in the top left. That is the backstage view, the dark or pale panel that holds Account and Options.<\/li>\n<li>Click Account. Some builds label it Office Account. The right side of the page is Product Information.<\/li>\n<li>Find Update Options. Click it, then Update Now. Stay on that screen. You should see a progress note, then a line that says you are up to date.<\/li>\n<li>If Word asks to close so it can finish, let it. Reopen Word when it is done.<\/li>\n<li>File, Account again. Read About Word. On Current Channel and retail Office 2024 \/ 2021 you want Version 2607, Build 20228.20190 or a later 2607 build. Monthly Enterprise shops want Build 20228.20188. LTSC 2024 wants 2408, Build 17932.20910. LTSC 2021 wants 2108, Build 14334.20848.<\/li>\n<li>If a document is already open, save it, then run Update Now. The updater often asks to close Word. Let it. Reopen the file only after File, Account shows the new build.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">If Update Options is missing<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The shop may have locked updates. Click-to-Run managed by IT will hide Update Now on purpose. Ask whoever images the PCs to push 2607. On a home PC, a missing Update Options often means a volume or LTSC install. Use the LTSC builds listed above, or Microsoft&#8217;s own update catalog, not a random &#8220;Office crack&#8221; installer. Microsoft Store installs of Office sometimes update through the Store instead of File, Account. Open the Store, Library, Get updates, and then confirm the build on File, Account anyway.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The shop PC and the other device<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Every Windows PC that launches Word, Excel, or Outlook gets the same File, Account click tonight. Watch the About line, not the splash that says you are up to date after a failed download.<\/li>\n<li>A Mac with Microsoft 365 Apps has Help, Check for Updates inside Word. Take 2607 there too.<\/li>\n<li>Office on the phone is not this updater. This brief is the desktop suite.<\/li>\n<li>Windows Update is a separate click and does not replace this. Do it if you owe it, but do not skip File, Account because Windows said it was current.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">What you should see<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Product Information lists the channel (Current Channel, Monthly Enterprise, or the LTSC name) and then Version and Build. Version 2607 is the month-train. Build 20228.20190 is the 11 August retail close. If the version still says 2606, you are on July&#8217;s train. Stay on Update Now until 2607 appears. If Word shows 2607 but a lower build than 20228.20190, you caught a mid-channel leftover. Run Update Now once more. About Excel should match About Word. That is the suite sharing one Click-to-Run engine.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When you are done<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">File, Account shows Version 2607 (or the LTSC build above) on the home PC and on the shop PCs that actually open attachments. About Word matches About Excel. That is expected. They share the updater. You do not need to rebuild the profile or turn off macros for this close. You needed the 11 August build on every PC that still opens attachments. You have it.<\/p>\n\n<div id=\"mwtad360014945\" class=\"gas_fallback-ad_176819-ad_309691-placement_400595\" style=\"margin-top: 50px;margin-bottom: 50px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"8386082122\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Office is how a file from email becomes a document on the PC. Microsoft&#8217;s 11 August security update for Microsoft 365 Apps closes a pile of Word and Office remote-code bugs. You do not need &#8230; <\/p>\n<p class=\"read-more-container\"><a title=\"A Word file can own the PC. Update Office to 2607\" class=\"read-more button\" href=\"https:\/\/malwaretips.com\/blogs\/office-2607-update\/#more-404548\" aria-label=\"Read more about A Word file can own the PC. Update Office to 2607\">Read more<\/a><\/p>\n","protected":false},"author":51,"featured_media":404580,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3605],"tags":[],"class_list":["post-404548","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","masonry-post","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/404548","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/users\/51"}],"replies":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/comments?post=404548"}],"version-history":[{"count":4,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/404548\/revisions"}],"predecessor-version":[{"id":404596,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/404548\/revisions\/404596"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media\/404580"}],"wp:attachment":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media?parent=404548"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/categories?post=404548"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/tags?post=404548"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}