CVE-2026-63515

This vulnerability is in Microsoft Office and can be triggered by a specially crafted document. If someone opens that document, Office may crash or—worse—allow an attacker to run code on the computer. Think of it like a flaw in how Office reads part of a file: a malicious file can “trick” Office into executing something it should not.

This matters to you if you use or manage Microsoft Office on employee computers—especially if you open email attachments, shared documents, or files from the internet. It applies across multiple Office offerings, including microsoft 365 apps and several office versions for Windows and for Mac.

This is only a risk if an attacker can deliver a crafted Office document to a user who then opens it in the affected Office version.

This should be treated as RED priority because press attention is linked to this Office security update and a serious threat actor (Lazarus group) has been associated in coverage. Even though no public exploit code is on record and it is not listed in CISA KEV, the impact (code execution in Office) is high.

Act now by updating all affected Office installs, since the safest path is to remove the vulnerable build.

Confirm if you’re exposed

1. On each affected computer, identify the Microsoft Office version/build.
   • Windows: open an Office app (e.g., Word) → look for Account/About/Version information.
   • Mac: open an Office app (e.g., Word/Excel) → check About/Version information.
2. Match the install to one of the affected product lines and compare its build to the fixed versions:
   • microsoft 365 apps: fixed via Microsoft’s Office security update releases (use the Microsoft-provided update guidance for CVE-2026-63515).
   • microsoft office (Windows): fixed in 16.0.5565.1001.
   • Microsoft Office 365 for Mac: fixed in 16.112.26081010.
   • Microsoft Office LTSC for Mac 2021: fixed in 16.112.26081010.
   • Microsoft Office LTSC for Mac 2024: fixed in 16.112.26081010.

Remediate (preferred)

3. Update Office to the fixed versions above.
   • Windows: update to 16.0.5565.1001 for microsoft office, and ensure microsoft 365 apps are updated through Microsoft’s OfficeSecurityReleases channel.
   • Mac: update to 16.112.26081010 for Microsoft Office 365 for Mac and both LTSC for Mac variants listed.
4. If you manage devices centrally, confirm update deployment succeeded on all endpoints (not just a subset).

If you can’t update immediately (temporary containment)

5. Reduce exposure to malicious documents:
   • block or restrict opening attachments from unknown/untrusted sources,
   • apply a “do not open unexpected Office files” rule for staff,
   • prioritize updating the most exposed users (email-heavy roles, contractors, external-facing teams).

What to monitor

6. After updating, keep an eye on:
   • Office application crashes after opening documents,
   • suspicious process activity launched from Office-related paths,
   • any endpoint alerts your security tooling generates around Office documents.

KEV timeline

No KEV listing was found for CVE-2026-63515 in the provided findings, so treat this as urgent based on the published fixes and associated threat-actor coverage rather than on confirmed KEV exploitation.

References (for your IT vendor)

• Microsoft update guide for CVE-2026-63515: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63515
• OfficeSecurityReleases (Microsoft 365 apps fixes): https://aka.ms/OfficeSecurityReleases

CVE-2026-63515 affects Microsoft Office products including microsoft 365 apps, microsoft office, and multiple Microsoft Office for Mac/LTSC for Mac editions. The weakness is categorized as CWE-125 and CWE-191, described as an out-of-bounds read in Microsoft Office.

Attack mechanism (high-level): a maliciously crafted Office document can trigger the out-of-bounds read when a user opens the file, potentially resulting in code execution within the context of the Office app. The provided CVSS vector indicates no prior authentication is needed (PR:N) and the user must interact with content (UI:R), consistent with “open the document” style delivery.

Exploitation status: no public exploit code was found in the provided findings, and the issue is not listed in CISA KEV. However, press coverage notes new activity and references Lazarus group, so operational risk is treated as high (system verdict: RED) based on the impact and threat coverage.

Patch availability: fixes are available for the affected branches, including Windows (microsoft office fixed in 16.0.5565.1001; microsoft 365 apps via OfficeSecurityReleases) and Mac (16.112.26081010 for Microsoft Office 365 for Mac and both LTSC for Mac 2021/2024).