CVE-2026-63513

This vulnerability is a weakness in how Microsoft Office reads certain graphics data inside an Office document. If someone sends a “booby-trapped” document and a user opens it, the file can trick Office into running malicious code on that computer. Think of it like a sketch in a file that contains instructions the program can follow once the file is opened.

This matters if your business uses Microsoft Office or Microsoft 365 Apps on Windows or macOS (including Microsoft Office 365 for Mac and Office LTSC for Mac 2021/2024). The risk depends on whether an attacker can get a malicious Office document to a user who will open it—there is no authentication needed, but user interaction (opening a file) is required. In practice, the main exposure is Office documents received via email or other file-sharing channels that employees open.

This is RED urgency because it’s a code-execution flaw in widely used Office software, and attackers only need to get a user to open a crafted file. The public reporting provided does not confirm exploitation specifically for this CVE, but Microsoft has shipped fixes—so treat it as a priority update across affected Office installations.