CVE-2026-63524

This vulnerability is like a “read mistake” inside Microsoft Office that could let an attacker pull out confidential information from the computer. The attack doesn’t usually happen just by visiting a website; it typically needs someone to trick you into opening a specially crafted Office document. If it succeeds, the attacker could learn sensitive information that should have stayed private.

This matters to you if you use Microsoft Office or Microsoft 365 Apps on the affected Windows/Mac versions listed for this CVE. It’s primarily a concern when someone can get a file onto a device that a user will open (for example, via a targeted email or similar local-access scenario), because user interaction is required to trigger it. The risk is mainly relevant when an attacker has local access and can induce a victim to open a crafted Office file.

Verdict: RED. Attackers are actively using Microsoft Office as a target in the wild (reported actor activity in the findings), and this bug can disclose confidential data when a user opens a crafted document. Even though a publicly dated exploitation claim isn’t included here, the combination of targeted targeting and a known patch makes it urgent to update promptly.

1. Identify your exact Office/365 version on every device in scope (Windows and Mac).
   • Confirm whether you run any of these: microsoft 365 apps, microsoft office, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, microsoft 365, office 2016, office 2019, office 2021, office 2024.
2. Determine whether you’re already on the fixed version:
   • For microsoft office (Windows): update to 16.0.5565.1001.
   • For Microsoft 365 Apps (Windows): update using the Microsoft Office security releases referenced by https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63524.
   • For Microsoft Office 365 for Mac / Microsoft Office LTSC for Mac 2021 / Microsoft Office LTSC for Mac 2024: update to 16.112.26081010.
3. Upgrade/patch plan:
   • Apply updates to users first on the highest-risk endpoints (shared computers, devices used for sensitive documents, and machines that receive frequent email/downloads).
   • Schedule a short window to update macOS devices as well, using the same fixed version target.
4. Temporary workaround if patching is delayed:
   • Prevent users from opening documents from untrusted sources (especially unexpected email attachments and downloaded files).
   • If your environment supports it, implement stricter file-source controls (email gateway policies and download restrictions) until updates are complete.
5. After updating:
   • Monitor for Office activity around any suspicious documents that were opened before patching.
   • Remove any known-malicious files and review the source (sender, hosting location, or device where the file originated).

KEV/CISA status: This CVE is not listed in CISA KEV per the provided findings.

Severity context: CVSS score is 5.5 (Medium). The issue is an information disclosure vulnerability (CWE-125) in Microsoft Office.

Mechanism and trigger: An out-of-bounds read occurs in Microsoft Office. A locally positioned attacker can reach this by delivering a specially crafted Office file that requires the victim to open it (user interaction required; no special privileges required for the attacker per the findings).

Exposure requirements: Local access is required, and user interaction is needed to trigger the vulnerability. Default reachability from the internet is unknown based on the findings provided.

Exploitation status: No KEV entry is provided, no public exploit code is on record, and provided news articles did not show evidence of exploitation for this specific CVE. However, the findings indicate press attention/new actor activity (Lazarus group) related to the patch.

Patch availability: Fixed versions are available for microsoft office (16.0.5565.1001), and for Microsoft Office Mac variants (16.112.26081010) plus Windows Microsoft 365 Apps fixes via Microsoft Office security releases.

EPSS note: EPSS is provided as a prediction with a flat trend; this is informational only and not used as a substitute for patching.