CVE-2026-63519

Think of Microsoft Office as a program that loads many different types of graphics inside documents. This bug is like a “broken lock” in one part of that graphics loading—if someone sends a specially made file, opening it can cause Office to run attacker code on your machine. Because it runs as the user who opened the file, it can quickly give an attacker access to whatever that user can access.

This matters if your business uses Microsoft Office or Microsoft 365 Apps on Windows/macOS, including Microsoft Office 2019, 2021, 2024, Microsoft Office 365 for Mac, and Microsoft Office LTSC for Mac 2021/2024. It does not require a login by the attacker, but it does require user interaction—someone has to open a specially crafted file in Office. Treat it as a risk when Office is reachable by everyday users through emails or downloaded attachments, because an attacker only needs a single “open this file” moment.

This is RED because it enables attackers to run arbitrary code on the machine of the person who opens the malicious file. It’s the kind of Office flaw that can be targeted in real campaigns (not just a theoretical issue), and you should prioritize patching on all Office endpoints.