What is the CVSS score of CVE-2026-63532?

CVE-2026-63532 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Office are affected by CVE-2026-63532?

CVE-2026-63532 enables local code execution across Microsoft Office versions (2016, 2019, LTSC 2021/2024, and Microsoft 365 Apps) with no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-63532?

Within 24 hours, distribute a security alert to all stakeholders and create a definitive inventory of Microsoft Office deployments across Windows and macOS systems, identifying which devices run Office 2016, 2019, LTSC 2021, LTSC 2024, or Microsoft 365 Apps for Enterprise. Within 7 days, deploy the patch available per vendor advisory to a pilot group representing 5-10% of the user population to validate stability and compatibility, then commence phased rollout prioritizing high-risk departments including finance, legal, and executive functions. Complete enterprise-wide patch deployment within 30 days; during this window, implement interim protections by disabling Office macro execution in security policies and restricting Office document execution from unverified external sources.

Microsoft Office CVE-2026-63532

EUVD-2026-56698 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-08-11 secure@microsoft.com

GHSA-7phx-8ch5-hmfm

Buffer Overflow Heap Overflow Microsoft 365 Apps Microsoft 365 Office 2021 Office 2024 Office 2019 Office 2016

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local file-parse trigger with no attacker privileges needed; user must open the file; full code execution yields complete CIA impact with unchanged scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:48 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.8

DescriptionCVE.org

Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Office results from an integer overflow that leads to a heap-based buffer overflow (CWE-122), enabling an attacker to run arbitrary code at the privilege level of the logged-in user. Affected products span multiple Windows and Mac release tracks including Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise. No public exploit or CISA KEV listing is present in the available data; however, the complete high CIA triad and wide deployment footprint make this a priority patching target.

Technical ContextAI

CWE-122 denotes a heap-based buffer overflow - a memory corruption class where an integer arithmetic wraparound causes an undersized heap allocation, and subsequent writes overwrite adjacent heap metadata or object pointers. The description labels the root trigger as an integer overflow (CWE-190 is the conceptual precursor), which then produces the heap overflow condition captured by CWE-122. This pattern is common in document parsers - a size field in a crafted Office file record is arithmetically manipulated to produce a near-zero or wrong allocation size, and parser logic then copies more bytes than the buffer can hold. The CVSS vector AV:L/UI:R confirms the vulnerability is triggered by parsing a locally-opened file, consistent with Office document format parsing (e.g., XLS, DOC, PPTX binary formats). Affected CPEs cover Microsoft 365, Office 2016/2019/2021/2024 on Windows, and Office LTSC/365 for Mac.

RemediationAI

Apply the vendor-released patch immediately. For Microsoft Office 2016 on Windows, update to build 16.0.5565.1001 or later. For macOS variants (Office LTSC for Mac 2021, LTSC for Mac 2024, and Office 365 for Mac), update to build 16.112.26081010 or later. For Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, and Office LTSC 2024 on Windows, consult https://aka.ms/OfficeSecurityReleases for the current patched build and apply it via Microsoft Update or your enterprise deployment tooling (WSUS, Intune, SCCM). If patching cannot be applied immediately, a compensating control is to configure email gateway and endpoint DLP policies to block or sandbox inbound Office documents from external senders before delivery - this raises the bar for the UI:R delivery step. Disabling macros alone is insufficient since the vulnerability resides in the document parser, not the macro engine. Protected View in Office will reduce (but not eliminate) exposure by opening untrusted documents in a restricted rendering mode, though this depends on the file origin being recognized as untrusted. The canonical advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63532.