CVE-2026-63521: Microsoft Word Information Disclosure

CVE-2026-63521 Overview

CVE-2026-63521 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Word. The flaw allows an unauthorized attacker to disclose sensitive information locally when a user opens a specially crafted document. Exploitation requires user interaction, and the attack vector is local. The vulnerability affects confidentiality but does not impact integrity or availability. Microsoft published details in the Microsoft CVE-2026-63521 Advisory.

Critical Impact
Successful exploitation exposes process memory contents from Microsoft Word, potentially revealing sensitive document data, credentials, or memory addresses useful for chaining with other exploits.

Affected Products

Microsoft Office Word (specific versions listed in the Microsoft advisory)

Discovery Timeline

2026-08-11 - CVE CVE-2026-63521 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-63521

Vulnerability Analysis

The vulnerability is an out-of-bounds read condition classified under [CWE-125]. Microsoft Word reads data past the end of an allocated buffer when parsing a malformed document structure. The improper bounds check causes the application to access memory outside the intended range. Attackers can leverage this to leak the contents of adjacent memory into an attacker-controlled context within the document rendering pipeline.

The issue is triggered locally and requires the victim to open a crafted file. It does not grant code execution or write access on its own. However, disclosed memory can include heap layout details, uninitialized data, or fragments of other documents opened in the same session. Attackers frequently combine information disclosure primitives with memory corruption bugs to bypass Address Space Layout Randomization (ASLR).

Root Cause

The root cause is missing or insufficient boundary validation when Word parses a specific object or field within a document. When the parser encounters a length or offset value that exceeds the allocated buffer, it continues reading, returning out-of-bounds memory to the caller. Microsoft's advisory contains the authoritative technical description and patched build numbers.

Attack Vector

The attacker delivers a crafted Word document through phishing, a shared file location, or a compromised website. The victim opens the file with a vulnerable version of Microsoft Word. Parsing the malicious structure triggers the out-of-bounds read, and the leaked memory contents are surfaced to attacker-controlled content within the document. No network access or elevated privileges are required. See the Microsoft CVE-2026-63521 Advisory for parser-level detail.

Detection Methods for CVE-2026-63521

Indicators of Compromise

Unexpected Microsoft Word crashes or Watson error reports referencing memory access violations during document open operations.
Word documents originating from untrusted senders that contain unusual embedded objects, malformed OLE streams, or non-standard field structures.
Outbound network requests from WINWORD.EXE to unfamiliar domains immediately following a document open event.

Detection Strategies

Enable Attack Surface Reduction (ASR) rules that block Office applications from creating child processes or making unusual network calls.
Ingest Microsoft Defender for Office 365 and endpoint telemetry into your SIEM to correlate document open events with anomalous process behavior.
Hunt for Word process crashes with exception codes consistent with read access violations, using Windows Error Reporting logs.

Monitoring Recommendations

Monitor WINWORD.EXE for unexpected memory operations, crashes, and outbound connections after opening documents from external sources.
Track email gateway telemetry for .docx, .doc, and .rtf attachments flagged with anomalous structures or obfuscated content.
Alert on execution of Word from unusual parent processes or from temporary directories used by email clients and browsers.

How to Mitigate CVE-2026-63521

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-63521 Advisory across all Word installations.
Enforce Protected View for documents originating from the internet, email attachments, and other untrusted locations.
Educate users to avoid opening unexpected Office documents, particularly those requesting content or macro enablement.

Patch Information

Microsoft has released a security update addressing the out-of-bounds read in the Word document parser. Administrators should deploy the patch through Windows Update, Microsoft Update Catalog, WSUS, or Microsoft Intune. Confirm patched build numbers on endpoints using the version information provided in the Microsoft advisory.

Workarounds

Block or quarantine inbound Office documents from untrusted senders at the email gateway until patching is complete.
Configure Group Policy to force Protected View for files from the internet, unsafe locations, and Outlook attachments.
Disable preview handlers for Word documents in Windows Explorer and Outlook to prevent silent parsing of untrusted files.

bash

# Configuration example: enforce Protected View via registry (per-user)
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f