CVE-2026-26110 [2] (in short: RCE in the Microsoft Office parser) is another warning sign: Microsoft has just patched a type confusion vulnerability in Microsoft Office, described as a vulnerability leading to remote code execution. In practice, it is another example showing that the problem is no longer limited to ?macros?, but includes a much broader attack surface in the document format itself and in Office parsers.
Treating macro signing as the main answer to document-related risk is now a very archaic approach. Macro and code signatures are, of course, still an important security control. But you have to ask whether a ?hacker? will not simply spend a few dollars on code signing.
Active or dangerous content can also hide in other parts of the file: external relationships, embedded objects, fields, templates, or unusual OOXML structures. That is why the time is coming for deep document sanitization: not just blocking macros, but disarming and reconstructing the entire file.
The nature of CVE-2026-26110 itself shows clearly that the ?document content? layer and Office parsers remain a real vector for code execution. It is no longer enough to teach users ?do not click links and unknown attachments?; we also have to teach that to Copilot (or other AI assistants).
I am impatiently waiting for someone to combine techniques from CVE-2026-0866 [1] (Zombie ZIP) with CVE-2026-26110. Yes, DOCX is a ZIP archive, and ZombieZip can make it unreadable for antivirus software, EDR, and other toys.
That is why deep document sanitization (Content Disarm & Reconstruction) increasingly seems like a sensible approach: analyzing and reconstructing a file instead of simply blocking macros.
Perhaps in many business processes it is worth returning to the question of whether we always need ?rich? formats. Sometimes a simpler format, and in some scenarios even good old RTF or other simplified ways of exchanging content, may be more reasonable for collecting data, CVs, or customer materials than the full, complex ecosystem of modern Office documents, Word files, and PowerPoint presentations.
Not because it is perfectly secure, but because reducing complexity very often reduces the attack surface as well.
…I am afraid I will come back to this topic again.
[1] https://isc.sans.edu/diary/rss/32786
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-26110