CVE-2026-63517: Microsoft Office Information Disclosure

CVE-2026-63517 Overview

CVE-2026-63517 is an out-of-bounds read vulnerability in Microsoft Office that allows a local, unauthorized attacker to disclose sensitive information. The flaw is classified under CWE-125 (Out-of-bounds Read) and requires user interaction to trigger. Exploitation typically occurs when a victim opens a specially crafted Office document, allowing the attacker to read memory contents outside the intended buffer boundaries. Microsoft published the advisory through the Microsoft Security Response Center.

Critical Impact
A successful exploit exposes confidential memory contents from the Office process, which may include document data, credentials, or other sensitive material held in memory.

Affected Products

Microsoft Office (specific versions listed in the Microsoft Security Update Guide)

Discovery Timeline

2026-08-11 - CVE-2026-63517 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-63517

Vulnerability Analysis

The vulnerability is an out-of-bounds read in Microsoft Office. When Office parses a malformed document, the affected code path reads memory beyond the bounds of an allocated buffer. This exposes adjacent memory contents to the attacker-controlled parsing logic. The disclosed data may include heap contents, pointers, or fragments of other documents processed in the same session.

The attack vector is local and requires user interaction. An attacker must convince the target to open a crafted file. The scope is unchanged, and the impact is limited to confidentiality — integrity and availability are not affected.

The EPSS score is 0.368%, indicating a low predicted probability of exploitation in the near term. No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is missing or insufficient bounds checking during document parsing. Office reads structured data from the file, and a malformed length or offset field causes the parser to access memory outside the intended buffer. This is a common pattern in complex file format parsers where field values are trusted without validation against buffer size.

Attack Vector

An attacker crafts a malicious Office document and delivers it via email, download, or shared storage. When the victim opens the document, the vulnerable parser processes the malformed structure and reads out-of-bounds memory. The attacker then extracts the disclosed data, typically by embedding it in document output, macros, or by exfiltrating it through a secondary channel.

See the Microsoft Security Update CVE-2026-63517 advisory for technical details specific to the vulnerable code path.

Detection Methods for CVE-2026-63517

Indicators of Compromise

Office documents from untrusted senders containing malformed or unusual internal structures that trigger parser errors
Unexpected Office process crashes or memory access violations logged in Windows Event Viewer
Outbound network connections from winword.exe, excel.exe, or powerpnt.exe immediately after document open

Detection Strategies

Monitor Office application telemetry for exception events and abnormal child process behavior after document open
Inspect inbound email attachments and file shares for Office documents containing anomalous embedded objects or malformed headers
Correlate document open events with subsequent memory read anomalies or unexpected data exfiltration patterns

Monitoring Recommendations

Enable Microsoft Defender attack surface reduction rules for Office child process creation and script blocking
Log Office process activity, including file opens, module loads, and network connections, to a centralized SIEM
Alert on Office processes making outbound connections to newly registered or uncategorized domains shortly after file open

How to Mitigate CVE-2026-63517

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as it is available for the affected Office channel
Restrict opening of Office documents from untrusted sources and enforce Protected View for documents originating from the internet
Educate users on the risk of opening unexpected Office attachments, especially those requesting the disabling of Protected View

Patch Information

Microsoft has published the fix through the Microsoft Security Response Center. Administrators should consult the Microsoft Security Update CVE-2026-63517 advisory for the specific build numbers and update channels applicable to their Office deployment.

Workarounds

Enforce Protected View and Application Guard for Office to open untrusted documents in an isolated container
Block Office documents from executing macros and embedded content via group policy until patching is complete
Use email gateway filtering to strip or sandbox Office attachments from external senders

bash

# Configuration example: enforce Protected View via Group Policy registry keys
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f