CVE-2026-63519

Think of Microsoft Office as a program that loads many different types of graphics inside documents. This bug is like a “broken lock” in one part of that graphics loading—if someone sends a specially made file, opening it can cause Office to run attacker code on your machine. Because it runs as the user who opened the file, it can quickly give an attacker access to whatever that user can access.

This matters if your business uses Microsoft Office or Microsoft 365 Apps on Windows/macOS, including Microsoft Office 2019, 2021, 2024, Microsoft Office 365 for Mac, and Microsoft Office LTSC for Mac 2021/2024. It does not require a login by the attacker, but it does require user interaction—someone has to open a specially crafted file in Office. Treat it as a risk when Office is reachable by everyday users through emails or downloaded attachments, because an attacker only needs a single “open this file” moment.

This is RED because it enables attackers to run arbitrary code on the machine of the person who opens the malicious file. It’s the kind of Office flaw that can be targeted in real campaigns (not just a theoretical issue), and you should prioritize patching on all Office endpoints.

Confirm exposure

• Inventory your devices for Microsoft Office installations: Microsoft 365 Apps, Microsoft Office (Windows desktop suite), Microsoft 365, Office 2019/2021/2024, Microsoft Office 365 for Mac, and Microsoft Office LTSC for Mac 2021/2024.
• Identify current macOS Office versions for the Mac products. (If you’re on macOS, pay special attention because the fixed version is explicitly stated.)
• Verify where users get files: email attachments, browser downloads, chat messages, and any shared-drive documents opened locally.

Apply the fix

• For Microsoft Office 365 for Mac and Microsoft Office LTSC for Mac 2021/2024: upgrade to 16.112.26081010.
• For Microsoft 365 Apps / Microsoft Office (and Microsoft 365 / Office 2019/2021/2024): install the Microsoft Office security update(s) identified for CVE-2026-63519 via the Microsoft Office Security Releases guidance.

If patching is delayed (temporary workaround)

• Block or quarantine unsolicited Office attachments where possible (email gateway rules and endpoint controls).
• Restrict who can open unknown attachments and enable user awareness prompts for “unexpected Office documents.”
• Focus on reducing the chance a malicious file is opened, since user interaction (opening a crafted file) is part of how this works.

What to monitor

• Office and endpoint security logs for suspicious child-process activity originating from Office apps after opening documents.
• Any unexpected network connections by Office-related processes on endpoints that recently opened email or downloaded files.

Timeline

• Because this is RED and Microsoft has released fixes, prioritize updates as soon as possible across all affected devices.

CVE-2026-63519 is a heap-based buffer overflow (CWE-122) in a Microsoft Office graphics component. The vulnerability can be triggered locally when a user opens a specially crafted file in Office; the attacker’s code can then execute with the privileges of the current user. The findings describe “Execute arbitrary commands or software with the privileges of the current user” with user interaction required.

• Exploitation: No confirmed CISA KEV listing, and no clear dated press claim or incidents were provided; no public exploit code was found in the findings.
• Campaign signal: PULSE reports actor activity associated with this CVE (Lazarus group), and the overall verdict is RED.
• Fix status: Microsoft provides patched releases, with macOS fixed at 16.112.26081010 for Microsoft Office 365 for Mac and Office LTSC for Mac 2021/2024; Windows/other Office products are addressed via Microsoft’s Office Security Releases update guidance for CVE-2026-63519.
• Attack vector model from findings: local trigger, no authentication required, user interaction required.