Use Microsoft Office? Hackers can infect your PC with a malicious document - patch it ASAP

Follow ZDNET: Add us as a preferred source on Google.

ZDNET's key takeaways

• Microsoft has released a patch to resolve a security flaw in Office.
• The flaw could let a malicious file attachment infect your PC.
• Office 2016 and 2019 users must manually update the program.

Microsoft has issued an emergency patch designed to resolve a zero-day security vulnerability affecting several versions of Microsoft Office. Already exploited in the wild, the flaw could allow an attacker to skirt past Office's built-in security measures and send victims a malicious document.

Zero-day vulnerability

In a note published Monday, Microsoft revealed details behind the flaw, known as a Microsoft Office Security Feature Bypass Vulnerability.

Also: Is turning off Windows Security a bad idea in 2026? A PC expert's bottom line

Tagged as CVE-2026-21509, this vulnerability bypasses the OLE mitigations in Microsoft 365 and Microsoft Office. OLE ...