CVE-2026-63526

Microsoft Office Graphics Component Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 38th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile38th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-14Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which Microsoft Office/Microsoft 365 apps you run (Windows Office vs Microsoft 365 Apps, and which version/build).\n2. Check whether your build is already on the fixed versions listed by Microsoft for CVE-2026-63526 (see Microsoft’s update guide).\n3. Update Microsoft Office to the fixed version: Microsoft Office 365 Apps and Microsoft 365 via Microsoft Office security releases; Microsoft Office (Windows) to 16.0.5565.1001; Microsoft Office for Mac / LTSC for Mac 2021 / LTSC for Mac 2024 to 16.112.26081010.\n4. If you cannot update immediately, stop opening files from unknown or unexpected sources and ensure risky documents are opened only in a protected context (e.g., Protected View) until updates are applied.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

In plain language

Written by AI from the record

This Microsoft Office graphics flaw can let attackers run code when you open a specially made document; most small businesses should treat it as urgent because it involves Office itself and a serious security fix is available for common Office versions.

CWE-121 stack-based buffer overflow in the Microsoft Office graphics component can lead to remote code execution when a user opens a crafted Office file; patching is required for affected Microsoft Office and Microsoft 365 builds.

If you're affected

Full takeover of Office session
Malware installed on the PC
Business data theft risk
Service disruption from infected devices

What is it

Imagine Office like a document “viewer” that also handles pictures and graphics. This bug is a mistake in how Office processes certain graphics inside a file; a specially made file could trick Office into running attacker code on your device. That’s why the safest move is to update Office right away.

Who is affected

This matters if you use or manage any of the listed Microsoft Office products on endpoints—especially Windows and macOS machines where people open Office documents. It only becomes a real risk if an attacker can get a crafted document to a user (the common pattern for this kind of issue is “when the file is opened”).

How urgent is it

This is marked RED because it is a serious Office code-execution type bug (remote code execution) and a fix is already available. There is also press attention tied to the vulnerability area, which increases the likelihood of active targeting even though no public exploit code is recorded right now.

What to do — in detail

Confirm exposure (find your exact build):\n - For Windows Microsoft Office/Microsoft 365 Apps: open an Office app (e.g., Word) → check About/Version information to identify the exact installed build.\n - For Microsoft Office on Windows (the “Microsoft Office” product line): verify whether your build is older than the fixed Windows Office build 16.0.5565.1001.\n - For Microsoft Office on macOS: verify the installed build for Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, or Microsoft Office LTSC for Mac 2024.\n2. Compare to fixed versions from Microsoft: \n - Microsoft 365 Apps: fixed via Microsoft’s OfficeSecurityReleases channel (use the vendor update guide for the exact rollup).\n - Microsoft 365: fixed via Microsoft’s OfficeSecurityReleases channel (use the vendor update guide).\n - Microsoft Office (Windows): fixed in 16.0.5565.1001.\n - Microsoft Office 365 for Mac: fixed in 16.112.26081010.\n - Microsoft Office LTSC for Mac 2021: fixed in 16.112.26081010.\n - Microsoft Office LTSC for Mac 2024: fixed in 16.112.26081010.\n3. Upgrade plan:\n - Prioritize workstations used to open emails and documents (sales, accounts, admin roles).\n - Apply Office updates per your normal update process (Microsoft security release updates for Microsoft 365 Apps/Microsoft 365; direct upgrade to the fixed build for “Microsoft Office” and macOS LTSC/Office-for-Mac lines).\n4. Temporary workaround if patching is delayed: \n - Treat unexpected Office files as risky until patched: avoid opening attachments from unknown senders and open untrusted documents only in Protected View where applicable.\n - If your organization already uses email/web filtering and attachment isolation, rely on it while updates are rolling out.\n5. What to monitor after updating: \n - Confirm Office version/build changed to the fixed values.\n - If you have endpoint detection tools, review alerts related to document opening and process launches from Office apps around the time of updates (to catch any suspicious activity that predated patching).\n6. Due date / KEV: \n - This CVE is not listed in the CISA KEV feed (per the findings), so focus on Microsoft’s patch timeline and internal rollout urgency rather than waiting for KEV-driven guidance.

Technical context

CVE-2026-63526 is a Microsoft Office graphics component vulnerability with weakness class CWE-121 (stack-based buffer overflow). The intended outcome for an attacker is to execute code by sending a crafted Office file that triggers the vulnerable graphics handling during user interaction (the vulnerability is consistent with “open a document” triggering execution).\n\nFindings indicate: no public exploit code is on record, and the CISA KEV listing is not present. EPSS is a low predicted likelihood and flat trend per the findings, but the overall verdict is RED due to severity (code execution) and active attention around the vulnerability area. Patch availability is confirmed with specific fixed builds/rollups for Microsoft 365 Apps/Microsoft 365, Microsoft Office (Windows) 16.0.5565.1001, and multiple Microsoft Office macOS variants fixed at 16.112.26081010. Actor press attention is noted (Lazarus group) by the findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS38th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 38th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 3 days, from the signal feeds we watch.

2026-08-14Patch availablerecord updated
2026-08-13OpenVAS check added
2026-08-12Record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US
- Microsoft 365 Apps for EnterpriseDesktop AppConsumer Software / productivity
- microsoft 365SaaS ServiceSaaSCloud & SaaS / saas-application
- office 2016Desktop AppOn-premConsumer Software / productivity
- office 2019Desktop AppOn-premConsumer Software / productivity
- office 2021Desktop AppOn-premConsumer Software / productivity
- office 2024Desktop AppOn-premConsumer Software / productivity
- Microsoft Office LTSC 2021Desktop AppConsumer Software / productivity
- Microsoft Office 365 for MacDesktop AppOn-premConsumer Software / productivity

And 6 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable