What is the CVSS score of CVE-2026-63513?

CVE-2026-63513 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Office are affected by CVE-2026-63513?

Microsoft Office 2016-2024 (including Microsoft 365) on Windows and macOS contain a buffer overflow vulnerability enabling local code execution when users open specially crafted documents.. A patch is available.

How to fix or mitigate CVE-2026-63513?

Within 24 hours, identify all Office 2016, 2019, 2021, and 2024 installations plus Microsoft 365 deployments in your environment and obtain the patch from Microsoft. Within 7 days, deploy the patch to a pilot group (10% of systems) to verify compatibility with critical business applications. Within 30 days, complete enterprise-wide patch deployment in managed waves, prioritizing systems with administrative privileges or sensitive data access.

Microsoft Office CVE-2026-63513

EUVD-2026-56419 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-08-11 secure@microsoft.com

GHSA-2xm7-6xcv-jfx8

Buffer Overflow Heap Overflow Microsoft 365 Apps Microsoft 365 Office 2021 Office 2024 Office 2019 Office 2016

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.8 HIGH

Local vector because exploitation requires user to open a delivered document; no privileges needed; full CIA impact on the process scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:54 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Heap-based buffer overflow in Microsoft Office enables local code execution with high impact across confidentiality, integrity, and availability. Affecting Office 2016 through 2024, including LTSC and Microsoft 365 variants on both Windows and macOS, the vulnerability is triggered when a user opens a specially crafted document - requiring no privileges but mandatory user interaction (CVSS AV:L/UI:R). Patch is available from Microsoft; no public exploit identified at time of analysis.

Technical ContextAI

CWE-122 (Heap-based Buffer Overflow) describes a condition where a program writes beyond the allocated boundaries of a heap memory region, corrupting adjacent heap metadata or data. In the context of Microsoft Office, this class of vulnerability typically manifests in document parsing logic - such as processing malformed records in legacy binary formats or structured content within modern Office Open XML files. Affected products span Office 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS platforms, as enumerated in the EUVD-2026-56419 affected version list. The attack surface is the Office document processing engine itself, meaning any feature that deserializes or renders user-supplied content could be the locus of the overflow. The local attack vector (AV:L) reflects that exploitation requires the malicious file to be present and opened on the victim system rather than being directly network-reachable.

RemediationAI

The primary fix is to apply Microsoft's released patches for each affected product. For macOS products (Office LTSC for Mac 2021, Office 365 for Mac, Office LTSC for Mac 2024), update to version 16.112.26081010 or later. For Microsoft Office 2016 on Windows, update to build 16.0.5565.1001 or later. For Microsoft Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise on Windows, consult https://aka.ms/OfficeSecurityReleases for the applicable fixed build. Updates can be applied via Microsoft Update, Windows Update for Business, or Microsoft 365 admin center depending on deployment type. As a compensating control where immediate patching is not feasible, organizations can configure Protected View and Attack Surface Reduction (ASR) rules to block Office from executing content from potentially untrusted sources - specifically the ASR rule 'Block Office applications from creating executable content' - noting that this may affect macro-enabled workflows. Disabling automatic opening of document attachments in email clients reduces delivery vector exposure but does not remediate the underlying flaw. The Microsoft MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63513 is the authoritative source for patch availability.