CVE-2026-63526
Microsoft Office Graphics Component Remote Code Execution Vulnerability
Description
Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
In plain language
AI Act nowThis Microsoft Office graphics flaw can let attackers run code when you open a specially made document; most small businesses should treat it as urgent because it involves Office itself and a serious security fix is available for common Office versions.
CWE-121 stack-based buffer overflow in the Microsoft Office graphics component can lead to remote code execution when a user opens a crafted Office file; patching is required for affected Microsoft Office and Microsoft 365 builds.
What to do now
- Check which Microsoft Office/Microsoft 365 apps you run (Windows Office vs Microsoft 365 Apps, and which version/build).\n2. Check whether your build is already on the fixed versions listed by Microsoft for CVE-2026-63526 (see Microsoft’s update guide).\n3. Update Microsoft Office to the fixed version: Microsoft Office 365 Apps and Microsoft 365 via Microsoft Office security releases; Microsoft Office (Windows) to 16.0.5565.1001; Microsoft Office for Mac / LTSC for Mac 2021 / LTSC for Mac 2024 to 16.112.26081010.\n4. If you cannot update immediately, stop opening files from unknown or unexpected sources and ensure risky documents are opened only in a protected context (e.g., Protected View) until updates are applied.
CVSS Vector Breakdown
AV:LAttack VectorAC:LAttack ComplexityPR:NPrivileges RequiredUI:RUser InteractionS:UScopeC:HConfidentialityI:HIntegrityA:HAvailabilityWeaknesses
Affected Products
Exploitability
Attack Graph
Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.
MITRE ATT&CK
1 techniqueReferences
- Microsoft Patch Tuesday for August 2026 — Snort rules and prominent vulnerabilitiesen·Cisco Talos· Exploited Windows patch-tuesday
- Microsoft Patch Tuesday, August 2026 Security Update Reviewen-us·Qualys Security Blog· Exploited Windows patch-tuesday
- Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-daysen-us·BleepingComputer· Exploited Windows Lazarus group
- Microsoft Patch Tuesday August 2026 - SANS ISCen·SANS Internet Storm Center· Exploited Windows zero-day
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2026-63526 and every CVE in our database. Create a free account — no credit card required.
Create Free Account