CVE-2026-63525: Microsoft Word RCE Vulnerability

CVE-2026-63525 Overview

CVE-2026-63525 is a numeric truncation error [CWE-197] in Microsoft Office Word. The flaw allows an unauthorized attacker to execute code locally on affected systems. Exploitation requires user interaction, typically opening a crafted Word document. Successful exploitation yields code execution in the context of the current user, with high impact to confidentiality, integrity, and availability.

Microsoft published a security update addressing the issue through the Microsoft Security Response Center.

Critical Impact
A crafted document can trigger a numeric truncation condition in Microsoft Office Word, resulting in local code execution under the invoking user's privileges.

Affected Products

Microsoft Office Word (specific versions listed in Microsoft's advisory)
Microsoft Office suites bundling the affected Word component
Refer to the Microsoft Security Update for CVE-2026-63525 for the authoritative build list

Discovery Timeline

2026-08-11 - CVE-2026-63525 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-63525

Vulnerability Analysis

CVE-2026-63525 stems from a numeric truncation error inside Microsoft Office Word's document parsing paths. Numeric truncation occurs when a value from a larger integer type is copied into a smaller type, discarding the high-order bits. When the truncated value drives buffer sizing, offset math, or loop counts, downstream code operates on incorrect bounds.

The attack requires the target to open a malicious document. Because the vector is local and user-driven, phishing lures and file-sharing services are the practical delivery paths. Once the document is opened, no additional privileges are needed for the attacker payload to run in the user's session.

Successful exploitation lets an attacker execute arbitrary code under the current user's account. From there, adversaries typically stage follow-on tooling, harvest credentials, and pivot laterally. Enterprises should treat any recipient of untrusted Office content as an exposed asset until the Microsoft patch is deployed.

Root Cause

The root cause is classified as CWE-197 (Numeric Truncation Error). A wider integer value, likely derived from parsed document structures, is stored into a narrower type. The truncated value then desynchronizes buffer allocation from actual data length, enabling memory corruption that leads to code execution.

Attack Vector

The attack vector is local with required user interaction. An attacker delivers a crafted .doc, .docx, or related Office file. When the user opens the document in a vulnerable Word build, the parser mishandles the truncated value and control flow is diverted into attacker-supplied code.

No verified public proof-of-concept is available at the time of publication. Technical specifics are described in prose only; consult the Microsoft Security Update for CVE-2026-63525 for vendor-provided detail.

Detection Methods for CVE-2026-63525

Indicators of Compromise

Unexpected child processes spawned by WINWORD.EXE, particularly cmd.exe, powershell.exe, rundll32.exe, or mshta.exe
Word writing executable content to user-writable paths such as %TEMP%, %APPDATA%, or %PUBLIC%
Outbound network connections from WINWORD.EXE to previously unseen hosts shortly after document open
Office documents delivered from external mail or file-share sources that trigger Protected View bypass prompts

Detection Strategies

Alert on Word process ancestry anomalies that indicate scripting or living-off-the-land binary execution
Hunt for suspicious file writes originating from Office processes, correlated with document open events
Inspect telemetry for WINWORD.EXE loading unusual DLLs or exhibiting anomalous thread creation
Cross-reference document hashes against threat intelligence feeds for Office weaponization campaigns

Monitoring Recommendations

Forward Sysmon Event IDs 1 (process create), 3 (network), and 11 (file create) from endpoints running Office to a central analytics platform
Track patch state of Microsoft Office builds against Microsoft's published fixed versions for CVE-2026-63525
Monitor email gateways for inbound Office attachments from untrusted senders and quarantine for detonation

How to Mitigate CVE-2026-63525

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-63525 across all endpoints running Microsoft Office Word
Prioritize deployment on high-risk users such as executives, finance, HR, and any staff handling external documents
Verify Protected View and Office Application Guard are enabled for documents originating from the internet
Block or sandbox Office attachments arriving from external senders at the email gateway

Patch Information

Microsoft has released fixes through the standard update channel. Refer to the Microsoft Security Update for CVE-2026-63525 for the definitive list of updated builds by product SKU and channel. Ensure Click-to-Run and MSI-based Office installations are both covered by your patch rollout.

Workarounds

Enforce Protected View for files originating from the internet, Outlook attachments, and unsafe locations
Configure Attack Surface Reduction (ASR) rules to block Office applications from creating child processes
Disable macros by default and require signed macros for internal document workflows
Restrict opening of untrusted .doc and .docx files pending patch validation

bash

# Enable ASR rule: Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Enforce Protected View via Group Policy registry keys (per Office version)
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f