CVE-2026-63524

This vulnerability is like a “read mistake” inside Microsoft Office that could let an attacker pull out confidential information from the computer. The attack doesn’t usually happen just by visiting a website; it typically needs someone to trick you into opening a specially crafted Office document. If it succeeds, the attacker could learn sensitive information that should have stayed private.

This matters to you if you use Microsoft Office or Microsoft 365 Apps on the affected Windows/Mac versions listed for this CVE. It’s primarily a concern when someone can get a file onto a device that a user will open (for example, via a targeted email or similar local-access scenario), because user interaction is required to trigger it. The risk is mainly relevant when an attacker has local access and can induce a victim to open a crafted Office file.

Verdict: RED. Attackers are actively using Microsoft Office as a target in the wild (reported actor activity in the findings), and this bug can disclose confidential data when a user opens a crafted document. Even though a publicly dated exploitation claim isn’t included here, the combination of targeted targeting and a known patch makes it urgent to update promptly.