CVE-2026-63525

Think of this like a “trap door” hidden inside a Word file. If someone sends you a specially crafted document, opening it could let an attacker run code on your computer. That can lead to things like malware infections or control of your device.

This matters if your business uses Microsoft Word (including Microsoft 365 Apps and supported Office desktop versions, such as Office 2019/2021/2024, and Microsoft Word 2016). The risk is mainly triggered when a user opens a malicious Word document, not just by having Word installed. Treat it as a real concern even without confirmed public exploit code, and focus on updating because the issue is tied to Word document handling and requires user interaction (the document must be opened).

This is RED because it’s a Microsoft Word remote code execution flaw and it has received security attention, including reporting associated with a major threat actor. Even though there is no KEV listing here, the fix is available now, and the behavior is exactly the kind attackers look for: delivering a crafted document that runs code when opened.

1. Confirm exposure (check installed versions)

   • Open Word → File → Account (or Help → About) and record:
     • Whether you’re on “Microsoft 365 Apps” vs “Microsoft Office” (2019/2021/2024) vs “Microsoft Word 2016”.
     • If it’s Word 2016, record the build number.

2. Apply the fix (use the vendor’s security releases)

   • For Microsoft 365 Apps and Microsoft Office (covers Office 2019/2021/2024 families as applicable):
     • Update to the latest security update available via the official Office security releases page linked by Microsoft for CVE-2026-63525.
   • For Microsoft Word 2016:
     • Upgrade Word to 16.0.5565.1000 (or later).

3. Verify the update worked

   • Re-check Word’s About/Account page after updating.
   • If Word 2016: confirm the build is at least 16.0.5565.1000.
   • For Microsoft 365 Apps / other Office versions: confirm you’re on the newest installed security update level (as shown in your Office update status).

4. Containment / temporary steps while updating

   • If you received any recent suspicious Word attachments or are unsure about files opened before patching, do not open more attachments from that sender.
   • Ensure antivirus/endpoint protection remains enabled and updated.
   • If you must open an untrusted document before updates complete, do so only if your organization has a safe document handling workflow; otherwise wait until the patch is installed.

5. What to monitor after patching

   • Look for alerts related to Office document opening, unusual spawned processes from Office applications, or endpoint detections around the times files were opened.
   • Watch for repeated email delivery attempts that try to get users to open new documents.

CVE-2026-63525 targets Microsoft Office Word and is categorized as CWE-197 (Improper Validation of Numeric Values). The core issue described is a numeric truncation error that can be leveraged to achieve Remote Code Execution in the context of a user opening a malicious document (user interaction is required).

Findings summary for handling priority: there is no KEV entry in CISA KEV, and no public exploit code is listed in the provided records; however, the patch is available (Microsoft has published an update guide for CVE-2026-63525) and press attention notes activity associated with Lazarus group.

KEV status here is “not listed,” so this is not supported as confirmed KEV exploitation from the provided findings; exploitation likelihood is therefore not asserted as confirmed, but the vulnerability class and the availability of fixes justify immediate remediation under the provided RED verdict.