CVE-2026-63532

Imagine Office opening a document the way a cashier scans a barcode. If the document is crafted to break the scanner’s logic, the “scan” can trigger something more than intended—like running malicious code on the computer. This vulnerability is specifically about Office getting tricked when opening a malicious file, which can lead to harmful activity on the device.

This matters if your business runs Microsoft Office desktop apps or Microsoft 365 Apps on PCs or Macs using Office 2016/2019/2021/2024, LTSC, or Microsoft Office 365 for Mac builds listed above. It’s not about someone “hitting” your server over the internet—this typically becomes a risk when a user opens a malicious Office document. The reachability gate is: you’re mainly exposed when an attacker can get a user to open a crafted Office file on a device running an affected Office build.

This is RED because it’s an Office remote code execution class flaw tied to opening untrusted files, and there’s press attention about a sophisticated actor (Lazarus group). Even though there’s no KEV listing and no public exploit code on record, the impact is severe and the available fix versions are known—so you should update immediately rather than waiting.

1. Inventory where this risk exists

   • Create a list of every computer and user account that runs any of these: microsoft 365 apps, microsoft 365, office 2016, office 2019, office 2021, office 2024, microsoft office, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024.

2. Confirm the exact installed build/version

   • For Office on Windows: open any Office app (for example Word) → File → Account. Record the version/build shown.
   • For Office on Mac: open an Office app (for example Word) → About Word/Office. Record the version/build.

3. Compare against the fixed versions

   • Windows Microsoft Office: fixed in 16.0.5565.1001.
   • Windows Microsoft 365 Apps: fixed in the latest build available via https://aka.ms/OfficeSecurityReleases.
   • Mac: fixed in 16.112.26081010 for Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024.

4. Upgrade to the fixed build

   • Apply the vendor’s Office update process so the fixed build is installed on each device.
   • After updating, re-check the Office “About”/“Account” screen to confirm the fixed build is actually present.

5. If you can’t update immediately (temporary control)

   • Reduce exposure to malicious documents right away by blocking or warning on unknown attachments and tightening email/document entry points (for example, ensure users do not open unexpected Office files).
   • Prioritize updating the most exposed machines: those used to open incoming email attachments or receive documents from external partners.

6. What to monitor after patching

   • Watch for unexpected Office behavior after document opens (unexpected prompts, new processes launched by Office, or alerts from your existing endpoint protection).
   • Confirm Office update compliance so devices don’t fall back to older builds.

CVE-2026-63532 is a Microsoft Office vulnerability involving an integer overflow/wraparound condition (CWE-122, CWE-190). The problem can allow unauthorized code execution tied to how malicious Office content is processed, with the practical trigger being user interaction (opening a crafted document).

Findings snapshot: it is not listed in the CISA KEV catalog; there is no public exploit code on record; exploitation likelihood is predicted as low (EPSS prediction exists but is not being treated as confirmation). Press attention highlights patching and mentions the Lazarus group, but exploit maturity/weaponization is not confirmed by the provided findings. The patch information clearly identifies fixed versions/builds for Windows and Mac, enabling straightforward remediation.