CVE-2026-63518

Think of Microsoft Word like a document reader. This flaw is a way to “break” Word’s document parsing so it can start running attacker-controlled code on the same computer as the person who opens the document. The practical danger is that a convincing email or file attachment could turn into full malware control of the device.

This matters if your business uses Microsoft Word through Microsoft 365 apps, Microsoft Office (including Office 2019/2021/2024), or Microsoft Office for Mac (including LTSC Mac 2021/2024).
The risk is mainly relevant when an attacker can deliver a specially made Word file to someone who will open it (or interact with it) in Word.

Verdict is RED: recent reporting associates this vulnerability with the Lazarus group, and it’s the kind of flaw that can lead to code running on the victim machine. Even though no public exploit code is recorded and it isn’t listed in CISA KEV, you should treat this as an urgent patching event because the consequence is high and a major threat actor is involved in ongoing targeting activity.