CVE-2026-63532

Imagine Office opening a document the way a cashier scans a barcode. If the document is crafted to break the scanner’s logic, the “scan” can trigger something more than intended—like running malicious code on the computer. This vulnerability is specifically about Office getting tricked when opening a malicious file, which can lead to harmful activity on the device.

This matters if your business runs Microsoft Office desktop apps or Microsoft 365 Apps on PCs or Macs using Office 2016/2019/2021/2024, LTSC, or Microsoft Office 365 for Mac builds listed above. It’s not about someone “hitting” your server over the internet—this typically becomes a risk when a user opens a malicious Office document. The reachability gate is: you’re mainly exposed when an attacker can get a user to open a crafted Office file on a device running an affected Office build.

This is RED because it’s an Office remote code execution class flaw tied to opening untrusted files, and there’s press attention about a sophisticated actor (Lazarus group). Even though there’s no KEV listing and no public exploit code on record, the impact is severe and the available fix versions are known—so you should update immediately rather than waiting.