CVE-2026-63518

Think of Microsoft Word like a document reader. This flaw is a way to “break” Word’s document parsing so it can start running attacker-controlled code on the same computer as the person who opens the document. The practical danger is that a convincing email or file attachment could turn into full malware control of the device.

This matters if your business uses Microsoft Word through Microsoft 365 apps, Microsoft Office (including Office 2019/2021/2024), or Microsoft Office for Mac (including LTSC Mac 2021/2024).
The risk is mainly relevant when an attacker can deliver a specially made Word file to someone who will open it (or interact with it) in Word.

Verdict is RED: recent reporting associates this vulnerability with the Lazarus group, and it’s the kind of flaw that can lead to code running on the victim machine. Even though no public exploit code is recorded and it isn’t listed in CISA KEV, you should treat this as an urgent patching event because the consequence is high and a major threat actor is involved in ongoing targeting activity.

1) Confirm whether you’re likely affected

• Windows (Microsoft 365 apps / Microsoft Office): determine whether your Office apps are currently up to date. In Word, open File → Account → About Word and record the version.
• Mac: in Word, open Word → About Word and record the exact version/build.

2) Validate against Microsoft’s fixed versions

Use Microsoft’s update guidance for CVE-2026-63518:

• Microsoft 365 apps: fixed via the latest updates published in OfficeSecurityReleases.
• Microsoft Office: fixed via the latest updates published in OfficeSecurityReleases.
• Microsoft Office 365 for Mac: fixed at 16.112.26081010.
• Microsoft Office LTSC for Mac 2021: fixed at 16.112.26081010.
• Microsoft Office LTSC for Mac 2024: fixed at 16.112.26081010.
• Microsoft Outlook 2016: fixed at 16.0.5565.1000 (if you use Outlook 2016 in the same environment).

3) Upgrade / patch path

• Microsoft 365 apps (Windows): apply the latest Office security updates from Microsoft’s Office security release process.
• Microsoft Office (Windows): apply the latest Office security updates from Microsoft’s Office security release process.
• Mac (listed Office Mac products): update to 16.112.26081010.

Microsoft’s reference for this specific CVE:

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63518

4) If patching is delayed (temporary containment)

• Immediately tighten email/file handling for Word attachments:
  • avoid opening unexpected Word attachments,
  • confirm urgent document requests via a separate channel (phone/chat) before opening,
  • restrict staff from downloading/opening attachments from unknown senders.
• Ensure endpoint protection is enabled and that devices receive updates promptly.

5) What to monitor after updating

• Monitor for any Word crashes or unusual Office behavior in the days after updates.
• Review email/security gateway logs for Word attachments that were opened before the update rollout.
• If your organization uses incident response playbooks, be ready to treat opened suspicious Word files as potential malware candidates.

Summary

• CVE-2026-63518 targets Microsoft Office Word with a heap-based buffer overflow (CWE-122) that can be triggered by a maliciously crafted document to achieve remote code execution in the context of the user opening the file.

Exploit / exposure signals from findings

• KEV: not listed in CISA KEV.
• Public exploit code: no public exploit code on record.
• Threat activity / press: PULSE notes press attention and links to the Lazarus group.

Risk signals

• Although the predicted likelihood (EPSS) is low and flat in the provided finding, the impact of Office Word code execution is significant (potential full control of the affected user’s device), which is why the overall handling is marked RED.

Attack vector and trigger (high level)

• A threat actor supplies a specially crafted Word document. When the user opens (and/or interacts with) the document in Word, the vulnerable parsing logic can be exploited to run attacker-controlled code locally on the user’s machine.