CVE-2026-63525

Think of this like a “trap door” hidden inside a Word file. If someone sends you a specially crafted document, opening it could let an attacker run code on your computer. That can lead to things like malware infections or control of your device.

This matters if your business uses Microsoft Word (including Microsoft 365 Apps and supported Office desktop versions, such as Office 2019/2021/2024, and Microsoft Word 2016). The risk is mainly triggered when a user opens a malicious Word document, not just by having Word installed. Treat it as a real concern even without confirmed public exploit code, and focus on updating because the issue is tied to Word document handling and requires user interaction (the document must be opened).

This is RED because it’s a Microsoft Word remote code execution flaw and it has received security attention, including reporting associated with a major threat actor. Even though there is no KEV listing here, the fix is available now, and the behavior is exactly the kind attackers look for: delivering a crafted document that runs code when opened.