CVE-2026-63518

Microsoft Office Word Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 39th percentile. Fixed versions are out.

CVSS 3.17.8High EPSS percentile39th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix5 products2 fixed builds listed below

Published 2026-08-11Updated 2026-08-14Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Microsoft 365 Apps for EnterpriseAffected: ≥ 16.0.1, < https://aka.ms/OfficeSecurityReleasesUpgrade to: https://aka.ms/OfficeSecurityReleasesStated by: CVE record
Microsoft Office 2019Affected: ≥ 19.0.0, < https://aka.ms/OfficeSecurityReleasesUpgrade to: https://aka.ms/OfficeSecurityReleasesAffected: ≥ 16.0.1, < https://aka.ms/OfficeSecurityReleasesUpgrade to: https://aka.ms/OfficeSecurityReleasesAffected: ≥ 16.0.0, < https://aka.ms/OfficeSecurityReleasesUpgrade to: https://aka.ms/OfficeSecurityReleasesStated by: CVE record
Microsoft Office 365 for MacAffected: ≥ 1.0.0, < 16.112.26081010Upgrade to: 16.112.26081010Stated by: CVE record
Microsoft Office LTSC for Mac 2021Affected: ≥ 16.0.1, < 16.112.26081010Upgrade to: 16.112.26081010Stated by: CVE record
Microsoft Office LTSC for Mac 2024Affected: ≥ 16.0.0, < 16.112.26081010Upgrade to: 16.112.26081010Stated by: CVE record

Versions as the sources state them. 1 more product has version data. Full version matrix after sign-in

Steps

Written by AI from the record

Check your Microsoft Word version(s): in Word, go to File → Account → About Word (or Word → About Word on Mac) and note the exact version/build.
Compare the version/build to the fixed releases:
- Microsoft 365 apps / Microsoft Office: install the latest update(s) from OfficeSecurityReleases.
- Microsoft Office 365 for Mac / Microsoft Office LTSC for Mac 2021 / Microsoft Office LTSC for Mac 2024: update to 16.112.26081010.
- Microsoft Office (Windows) / Office 2019/2021/2024: ensure you’re updated to the Microsoft-provided fixed release from OfficeSecurityReleases.
Update immediately using Microsoft’s security update guidance for CVE-2026-63518.
Until everyone is updated, block risky email behavior: treat unexpected Word attachments as unsafe and avoid opening them unless you can verify the sender and content.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

In plain language

Written by AI from the record

This is a Microsoft Word security flaw that can let an attacker run code when a user opens a specially made document, and you should update right away—especially if your team receives emails with Word files.

CVE-2026-63518 is a heap-based buffer overflow (CWE-122) in Microsoft Office Word that can be triggered by a specially crafted Word document to achieve remote code execution in the context of the user opening the file; patches are available for Microsoft 365 apps, Microsoft Office, and multiple Mac Office builds.

If you're affected

Full device takeover
Malware installation
Data theft risk
Business disruption

What is it

Think of Microsoft Word like a document reader. This flaw is a way to “break” Word’s document parsing so it can start running attacker-controlled code on the same computer as the person who opens the document. The practical danger is that a convincing email or file attachment could turn into full malware control of the device.

Who is affected

This matters if your business uses Microsoft Word through Microsoft 365 apps, Microsoft Office (including Office 2019/2021/2024), or Microsoft Office for Mac (including LTSC Mac 2021/2024).
The risk is mainly relevant when an attacker can deliver a specially made Word file to someone who will open it (or interact with it) in Word.

How urgent is it

Verdict is RED: recent reporting associates this vulnerability with the Lazarus group, and it’s the kind of flaw that can lead to code running on the victim machine. Even though no public exploit code is recorded and it isn’t listed in CISA KEV, you should treat this as an urgent patching event because the consequence is high and a major threat actor is involved in ongoing targeting activity.

What to do — in detail

1) Confirm whether you’re likely affected

Windows (Microsoft 365 apps / Microsoft Office): determine whether your Office apps are currently up to date. In Word, open File → Account → About Word and record the version.
Mac: in Word, open Word → About Word and record the exact version/build.

2) Validate against Microsoft’s fixed versions

Use Microsoft’s update guidance for CVE-2026-63518:

Microsoft 365 apps: fixed via the latest updates published in OfficeSecurityReleases.
Microsoft Office: fixed via the latest updates published in OfficeSecurityReleases.
Microsoft Office 365 for Mac: fixed at 16.112.26081010.
Microsoft Office LTSC for Mac 2021: fixed at 16.112.26081010.
Microsoft Office LTSC for Mac 2024: fixed at 16.112.26081010.
Microsoft Outlook 2016: fixed at 16.0.5565.1000 (if you use Outlook 2016 in the same environment).

3) Upgrade / patch path

Microsoft 365 apps (Windows): apply the latest Office security updates from Microsoft’s Office security release process.
Microsoft Office (Windows): apply the latest Office security updates from Microsoft’s Office security release process.
Mac (listed Office Mac products): update to 16.112.26081010.

Microsoft’s reference for this specific CVE:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63518

4) If patching is delayed (temporary containment)

Immediately tighten email/file handling for Word attachments:
- avoid opening unexpected Word attachments,
- confirm urgent document requests via a separate channel (phone/chat) before opening,
- restrict staff from downloading/opening attachments from unknown senders.
Ensure endpoint protection is enabled and that devices receive updates promptly.

5) What to monitor after updating

Monitor for any Word crashes or unusual Office behavior in the days after updates.
Review email/security gateway logs for Word attachments that were opened before the update rollout.
If your organization uses incident response playbooks, be ready to treat opened suspicious Word files as potential malware candidates.

Technical context

Summary

CVE-2026-63518 targets Microsoft Office Word with a heap-based buffer overflow (CWE-122) that can be triggered by a maliciously crafted document to achieve remote code execution in the context of the user opening the file.

Exploit / exposure signals from findings

KEV: not listed in CISA KEV.
Public exploit code: no public exploit code on record.
Threat activity / press: PULSE notes press attention and links to the Lazarus group.

Risk signals

Although the predicted likelihood (EPSS) is low and flat in the provided finding, the impact of Office Word code execution is significant (potential full control of the affected user’s device), which is why the overall handling is marked RED.

Attack vector and trigger (high level)

A threat actor supplies a specially crafted Word document. When the user opens (and/or interacts with) the document in Word, the vulnerable parsing logic can be exploited to run attacker-controlled code locally on the user’s machine.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS39th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 39th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 3 days, from the signal feeds we watch.

2026-08-14Patch availablerecord updated
2026-08-13OpenVAS check added
2026-08-12Record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US
- Microsoft 365 Apps for EnterpriseDesktop AppConsumer Software / productivity
- Microsoft Office LTSC 2021Desktop AppConsumer Software / productivity
- Microsoft Office 365 for MacDesktop AppOn-premConsumer Software / productivity
- Microsoft Office LTSC for Mac 2021Desktop AppOn-premConsumer Software / productivity
- Microsoft Office LTSC for Mac 2024Desktop AppOn-premConsumer Software / productivity
- Microsoft Outlook 2016Desktop AppOn-premConsumer Software / productivity
- microsoft 365SaaS ServiceSaaSCloud & SaaS / saas-application
- office 2019Desktop AppOn-premConsumer Software / productivity

And 6 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable