CVE-2026-63513

This vulnerability is a weakness in how Microsoft Office reads certain graphics data inside an Office document. If someone sends a “booby-trapped” document and a user opens it, the file can trick Office into running malicious code on that computer. Think of it like a sketch in a file that contains instructions the program can follow once the file is opened.

This matters if your business uses Microsoft Office or Microsoft 365 Apps on Windows or macOS (including Microsoft Office 365 for Mac and Office LTSC for Mac 2021/2024). The risk depends on whether an attacker can get a malicious Office document to a user who will open it—there is no authentication needed, but user interaction (opening a file) is required. In practice, the main exposure is Office documents received via email or other file-sharing channels that employees open.

This is RED urgency because it’s a code-execution flaw in widely used Office software, and attackers only need to get a user to open a crafted file. The public reporting provided does not confirm exploitation specifically for this CVE, but Microsoft has shipped fixes—so treat it as a priority update across affected Office installations.

1. Inventory (confirm exposure)

   • List the Microsoft Office/Microsoft 365 products installed (Windows and macOS) on each workstation and server.
   • Determine the exact version/build number for each Office installation.

2. Compare to the fixed versions (decide what to upgrade)

   • Microsoft 365 Apps: update using Microsoft’s Office security releases.
   • Microsoft Office (Windows): update to 16.0.5565.1001.
   • Microsoft Office 365 for Mac: update to 16.112.26081010.
   • Microsoft Office LTSC for Mac 2021: update to 16.112.26081010.
   • Microsoft Office LTSC for Mac 2024: update to 16.112.26081010.

3. Apply updates

   • Roll out updates to managed devices via your normal Microsoft Office update process.
   • For immediate risk reduction, prioritize machines used by staff who frequently open email attachments or shared documents.

4. Temporary workaround if patching is delayed

   • Quarantine or block unsolicited Office attachments from external sources.
   • Tighten email handling rules (for example: reduce automatic opening and treat unexpected file types as suspicious).
   • Encourage staff to verify unexpected document senders and avoid opening unknown files.

5. After updating (what to monitor)

   • Confirm update success by re-checking Office version/build numbers on endpoints.
   • Watch for any endpoint security alerts related to suspicious Office activity (only as guidance—no specific indicators were provided for this CVE).

Severity is high (CVSS 7.8) with the core requirement that a user opens a specially crafted Office document; there’s no need for the attacker to authenticate to the system. The underlying weakness is a heap-based buffer issue in Microsoft Office’s graphics component parsing (CWE-122), which can be leveraged to achieve remote code execution on the local machine once the malicious file is opened.

KEV status: not listed in CISA KEV per the provided findings. Exploitation status from the provided materials: no dated public reporting found that specifically claims exploitation of CVE-2026-63513; some press material mentioned other CVEs as being exploited in the wild, but not this one. Patch availability: fixed updates are available for Microsoft 365 Apps and for multiple Microsoft Office Windows/macOS product lines with specific fixed version/build numbers. No public exploit code is recorded in the provided findings. EPSS is reported as a low predicted likelihood and flat trend; however, the decisive factor here is patch availability and the confirmed RED treatment for this CVE in the provided system context.