CVE-2026-63518: Microsoft Word Buffer Overflow Vulnerability

CVE-2026-63518 Overview

CVE-2026-63518 is a heap-based buffer overflow vulnerability in Microsoft Office Word. The flaw allows an unauthorized attacker to execute arbitrary code locally on a targeted system. Successful exploitation requires user interaction, typically opening a specially crafted document. The vulnerability is classified under CWE-122, which covers heap-based buffer overflows. The issue carries a CVSS 3.1 base score of 7.8 and impacts confidentiality, integrity, and availability. Microsoft published details through the Microsoft Security Update Guide.

Critical Impact
Attackers can achieve local code execution in the context of the current user by delivering a malicious Word document.

Affected Products

Microsoft Office Word (specific versions listed in the Microsoft Security Update Guide)

Discovery Timeline

2026-08-11 - CVE-2026-63518 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-63518

Vulnerability Analysis

CVE-2026-63518 is a heap-based buffer overflow in Microsoft Office Word. The vulnerability occurs when Word parses malformed structures in a document and writes data past the bounds of a heap-allocated buffer. Corrupting adjacent heap memory allows an attacker to influence program control flow and execute arbitrary code in the process context.

Exploitation requires the victim to open a crafted document. Because Word runs with the privileges of the invoking user, code execution inherits those privileges. Chaining this flaw with a local privilege escalation issue could extend attacker control across the host.

The EPSS score of 0.359% (28.868 percentile) reflects the current low probability of observed exploitation, but heap-based memory corruption bugs in Office applications are historically valuable in phishing-driven intrusion chains.

Root Cause

The root cause is improper validation of size or bounds during parsing of document content, categorized as CWE-122. A miscalculated allocation or unchecked copy operation writes attacker-controlled data beyond the intended heap buffer. Microsoft has not published root-cause internals; see the Microsoft Security Update Guide for advisory information.

Attack Vector

The attack vector is local and requires user interaction. A typical delivery path involves emailing a crafted .doc or .docx file, hosting it on a share, or embedding it in a phishing campaign. When the target opens the file in Word, the vulnerable parser processes the malicious content and triggers the overflow. Preview handlers may also render document content and expand the exposure.

No public proof-of-concept exploit or exploit-DB entry is listed for this CVE at the time of publication.

Detection Methods for CVE-2026-63518

Indicators of Compromise

Unexpected child processes spawned by WINWORD.EXE, such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Word writing executable content or scripts to user-writable paths including %APPDATA%, %TEMP%, and %LOCALAPPDATA%.
Outbound network connections initiated directly by WINWORD.EXE to untrusted hosts shortly after document open.
Crash reports referencing heap corruption in Word modules, including Windows Error Reporting (WER) entries.

Detection Strategies

Deploy behavioral rules that flag Office applications spawning script interpreters or LOLBins.
Enable and monitor Microsoft Attack Surface Reduction (ASR) rules that block child process creation by Office.
Inspect email gateways for documents containing unusual embedded objects, macros, or malformed OLE structures.
Correlate document open events with subsequent process, file, and network activity through EDR telemetry.

Monitoring Recommendations

Log Sysmon Event IDs 1 (process create), 11 (file create), and 3 (network) for WINWORD.EXE and forward to a central data lake.
Track WER crashes in Microsoft-Windows-Windows Error Reporting/Operational for Word application faults.
Monitor HKCU\Software\Microsoft\Office\<version>\Word\Resiliency for entries indicating crashes tied to document opens.
Alert on high-volume document delivery from external senders to executives and finance personnel.

How to Mitigate CVE-2026-63518

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Word installations.
Enable Protected View and Office Application Guard for documents originating from the internet or email.
Enforce ASR rules that block Office applications from creating child processes and injecting into other processes.
Restrict macro execution to signed macros from trusted publishers using Group Policy.

Patch Information

Microsoft has released a security update addressing CVE-2026-63518. Refer to the Microsoft Security Update Guide for the specific KB numbers, affected Office channels, and build versions that resolve the vulnerability. Deploy through Microsoft Update, WSUS, Intune, or Microsoft Configuration Manager based on your patch management workflow.

Workarounds

Open untrusted documents only within Protected View and never disable it for external content.
Use Office File Block policy to prevent legacy binary Word formats from opening in editable mode.
Route inbound documents through a sandbox or content disarm and reconstruction (CDR) pipeline before delivery.
Restrict standard users from local administrator rights to limit post-exploitation impact.

bash

# Example Group Policy registry configuration to enforce Protected View for internet-sourced documents
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f