What is the CVSS score of CVE-2026-63533?

CVE-2026-63533 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Office are affected by CVE-2026-63533?

Microsoft Office installations across enterprise environments are vulnerable to remote code execution (CVE-2026-63533, CVSS 7.8) via phishing and malicious documents-a proven attack vector for…. A patch is available.

How to fix or mitigate CVE-2026-63533?

Within 24 hours, issue a user security advisory emphasizing caution with unexpected Office documents and disabling macros where feasible. Within 7 days, inventory all Microsoft Office installations across the organization to identify affected versions and prioritize systems used by high-value targets (executives, finance, engineering). Within 30 days, deploy the vendor-released patch to 100% of affected Office instances, beginning with priority systems, validating deployment through endpoint management tools and confirming patch installation blocks the execution path.

Microsoft Office CVE-2026-63533

EUVD-2026-56699 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-08-11 secure@microsoft.com

GHSA-625x-f6gf-q9j2

Buffer Overflow Heap Overflow Microsoft 365 Apps Microsoft 365 Office 2021 Office 2024 Office 2019 Office 2016

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector with UI:R matches malicious document attack pattern; PR:N because any user account can open a file, no elevated privileges needed.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:46 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Heap-based buffer overflow in Microsoft Office allows local code execution across a wide range of Office versions on both Windows and macOS when a victim opens a specially crafted document. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms that no privileges are required - only that a user interacts with malicious content - making this practically reachable via phishing or drive-by document delivery despite the local attack vector. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; a vendor-released patch is available.

Technical ContextAI

CWE-122 (Heap-based Buffer Overflow) indicates the vulnerability resides in Office's document parsing or rendering code, where a specially crafted input causes a write beyond the bounds of a heap-allocated buffer. Heap overflows in document parsers are historically exploitable for arbitrary code execution by overwriting adjacent heap metadata or function pointers. Affected products span the full current Microsoft Office product line: Office 2016 (Windows), Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise (Windows), Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024. The breadth of affected SKUs suggests the vulnerable code path is present in a shared parsing component common to all of these variants. The CVSS local attack vector (AV:L) combined with user interaction required (UI:R) is consistent with a malicious file that must be opened by the victim - the attack surface is the Office document parser, not a network-facing service.

RemediationAI

Apply the vendor-released patch immediately. For macOS deployments (Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024), update to build 16.112.26081010 or later via Microsoft AutoUpdate or organizational deployment tooling. For Windows deployments of Office 2016, update to build 16.0.5565.1001 or later. For Windows deployments of Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise, the patched build version is specified at https://aka.ms/OfficeSecurityReleases - consult that page for the exact target version and apply via Windows Update, Microsoft Update Catalog, or your endpoint management platform (e.g., WSUS, SCCM, Intune). The MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63533 is the authoritative source. If patching cannot be applied immediately, a partial compensating control is to configure email gateway policies to block or sandbox Office documents arriving from external senders (e.g., enforce Protected View or Application Guard for all externally sourced Office files), which does not remediate the vulnerability but raises the bar for exploitation by preventing automatic execution when users open such documents. Note that Protected View bypass vulnerabilities have historically existed and this is not a complete mitigation.