What is the CVSS score of EUVD-2026-56424?

EUVD-2026-56424 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Office are affected by EUVD-2026-56424?

A vulnerability in Microsoft Office (affecting 365 Apps, Office 2019, LTSC 2021, LTSC 2024, and macOS versions) allows attackers to execute code with full user privileges by embedding malicious…. A patch is available.

Microsoft Office EUVD-2026-56424

Q: How to fix or mitigate EUVD-2026-56424?

Within 24 hours, inventory all affected Microsoft Office installations across the organization and establish a prioritized deployment plan for systems in sensitive roles. Within 7 days, deploy Microsoft's released security patches to all versions including Microsoft 365 Apps for Enterprise, Office 2019, LTSC 2021, LTSC 2024, and macOS equivalents using your standard change management process. Within 30 days, verify patch deployment coverage across all endpoints, audit system logs for exploitation attempts, and reinforce security awareness regarding untrusted document handling.

| CVE-2026-63519 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-08-11 secure@microsoft.com

GHSA-7vp4-c5c5-q52v

Buffer Overflow Heap Overflow Microsoft 365 Apps Microsoft 365 Office 2021 Office 2024 Office 2019

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

AV:L and PR:N reflect file-based delivery requiring no attacker privileges; UI:R captures the mandatory victim-opens-file gating condition; C/I/A:H reflects full session compromise upon successful exploitation.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:52 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Office is possible when a user opens a specially crafted document that triggers a heap-based buffer overflow (CWE-122), granting the attacker full control over the victim's user session. The vulnerability spans the entire modern Office portfolio - Microsoft 365 Apps for Enterprise, Office 2019, LTSC 2021, LTSC 2024, and macOS equivalents - making the attack surface exceptionally broad. No public exploit identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; Microsoft has released patches for all affected product lines.

Technical ContextAI

CWE-122 (Heap-based Buffer Overflow) describes a condition where a program writes data beyond the bounds of a heap-allocated memory region, potentially overwriting adjacent heap metadata or function pointers. In the Microsoft Office context, this class of bug typically occurs within document-format parsers (e.g., OLE, OOXML, RTF, or embedded object handlers) when field lengths or object sizes from a crafted file are not properly validated before memory writes. Affected products confirmed by EUVD data include Microsoft Office 365 for Mac, Office LTSC 2021 (Windows and Mac), Microsoft 365 Apps for Enterprise, Office LTSC 2024 (Windows and Mac), and Office 2019. The CVSS vector AV:L/PR:N/UI:R reflects Microsoft's standard taxonomy for file-based Office exploits: the malicious file must reach the local filesystem and the victim must open it, but the attacker requires no pre-existing system privileges.

RemediationAI

Apply vendor-released patches immediately via Microsoft's standard Office update mechanism. For all Windows-based Office products (Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024), Microsoft has released fixes referenced at https://aka.ms/OfficeSecurityReleases - consult that page for the exact build numbers applicable to each channel (Current, Monthly Enterprise, Semi-Annual). For macOS Office products (Office 365 for Mac, Office LTSC for Mac 2021, Office LTSC for Mac 2024), update to version 16.112.26081010 or later via Microsoft AutoUpdate or the Mac App Store. If immediate patching is not feasible, the most actionable compensating control is to enable Protected View for all documents originating from the internet or email (already on by default in most configurations) - this prevents full document parsing until the user explicitly enables editing, breaking the exploit chain at UI:R. Additionally, consider configuring Attack Surface Reduction (ASR) rules in Microsoft Defender to block Office applications from creating child processes. Note that Protected View bypass vulnerabilities exist historically, so patching remains the only reliable remediation.