What is the CVSS score of CVE-2026-63517?

CVE-2026-63517 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-63517?

Yes, a patch is available for CVE-2026-63517. Update the affected software to the latest version immediately.

Microsoft Office CVE-2026-63517

EUVD-2026-56421 MEDIUM

Out-of-bounds Read (CWE-125)

2026-08-11 secure@microsoft.com

GHSA-qcgw-c39h-2v8h

Buffer Overflow Information Disclosure Microsoft 365 Apps Microsoft 365 Office 2021 Office 2024 Office 2019 Office 2016

5.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local vector because exploitation requires the victim to open a crafted file; no integrity or availability impact since only adjacent memory is read.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 22:27 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

MEDIUM 5.5

DescriptionCVE.org

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

AnalysisAI

Out-of-bounds read in Microsoft Office exposes sensitive in-process memory contents to local attackers who socially engineer a victim into opening a crafted document. The flaw spans the full Microsoft Office portfolio across Windows and macOS - from Office 2016 through Microsoft 365 Apps for Enterprise - making it broadly relevant for enterprise patch management. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; vendor patch is confirmed available.

Technical ContextAI

The root cause is CWE-125 (Out-of-Bounds Read): during parsing of a maliciously crafted Office document, the application reads memory beyond the intended buffer boundary, exposing adjacent process memory. Despite being tagged 'Buffer Overflow' in the intelligence feed, the CWE classification correctly identifies this as a read-side overrun, which yields information disclosure rather than arbitrary code execution. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms a local attack vector requiring user interaction but no attacker-side privileges. Affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, Office 2016 (Windows), and Office 365 for Mac, LTSC for Mac 2021/2024 (macOS), covering both channel-update and perpetual-license deployments.

RemediationAI

The definitive fix is to apply Microsoft's released patch. For Windows channel-updated editions (Microsoft 365 Apps for Enterprise, Office LTSC 2024, LTSC 2021, Office 2019), apply the latest update via https://aka.ms/OfficeSecurityReleases. For Microsoft Office 2016 on Windows, upgrade to version 16.0.5565.1001 or later - this is the only edition with an exact confirmed fix build in the available data. For macOS editions (Office 365 for Mac, LTSC for Mac 2021, LTSC for Mac 2024), upgrade to version 16.112.26081010 or later. For organizations unable to patch immediately, enforce Protected View for all documents received from email or the internet (File > Options > Trust Center), which limits document rendering and reduces parser exposure - note this does not guarantee the flaw cannot be triggered and is not a substitute for patching. Additionally, restrict untrusted document handling via Group Policy (DisableAttachementsInPV) and block macro execution from internet-sourced files. Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63517.