CVE-2026-63528 Overview
CVE-2026-63528 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Word. An unauthorized attacker can exploit the flaw to disclose information locally when a user opens a crafted document. Exploitation requires user interaction but no authentication. The vulnerability affects confidentiality only; integrity and availability are not impacted.
Microsoft published details in the Microsoft Security Update CVE-2026-63528 advisory. The CVSS 3.1 vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The EPSS score is 0.352% at the 28.162 percentile as of 2026-08-13.
Critical Impact
A crafted Word document can leak sensitive memory contents from the Office Word process to an attacker, enabling further reconnaissance or exploit chaining.
Affected Products
- Microsoft Office Word (see the Microsoft advisory for the exact build list)
Discovery Timeline
- 2026-08-11 - CVE-2026-63528 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-63528
Vulnerability Analysis
The issue is an out-of-bounds read within Microsoft Office Word's document parsing logic. When Word processes a malformed document structure, it reads memory outside the intended buffer boundary. The read data can then be reflected back to attacker-controlled fields in the document, exposing residual heap or stack contents.
Because the flaw only exposes information rather than corrupting memory, it does not directly permit code execution. However, leaked memory frequently contains pointers, tokens, or document data useful for bypassing address space layout randomization (ASLR) or staging follow-on attacks.
Root Cause
The root cause is missing or insufficient bounds validation on a length or offset field within a Word document structure. The parser trusts an attacker-controlled size and reads past the allocated buffer. This behavior is characteristic of [CWE-125] Out-of-bounds Read.
Attack Vector
Exploitation is local and requires user interaction. An attacker delivers a crafted .doc, .docx, or related Word-supported file via email, web download, or file share. The victim must open the document in Microsoft Office Word to trigger the parsing path. No elevated privileges are required by the attacker, and no prior authentication is needed on the target system.
No verified public proof-of-concept code is available for CVE-2026-63528. See the Microsoft Security Update CVE-2026-63528 advisory for technical details.
Detection Methods for CVE-2026-63528
Indicators of Compromise
- Unexpected Word documents arriving from external senders, particularly with unusual embedded objects, malformed OLE streams, or oversized structure fields.
- WINWORD.EXE crashes or Windows Error Reporting entries referencing access violations during document open.
- Outbound network connections initiated by WINWORD.EXE shortly after opening an untrusted document.
Detection Strategies
- Inspect email and web gateways for Office documents with anomalous structural metadata using static document analyzers.
- Correlate process telemetry showing WINWORD.EXE spawning child processes or accessing sensitive files immediately after document open events.
- Apply YARA rules that flag malformed OOXML or legacy binary Word structures with out-of-range length fields.
Monitoring Recommendations
- Track Office application crash events (Windows Event ID 1000) with faulting module tied to Word document parsing components.
- Monitor file provenance using Mark-of-the-Web (MOTW) attributes to prioritize documents originating from the internet.
- Alert on Word processes reading unusual memory ranges or emitting large outbound payloads after opening a document.
How to Mitigate CVE-2026-63528
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-63528 advisory to all systems running Microsoft Office Word.
- Enforce Protected View for documents originating from the internet and email attachments.
- Restrict opening of legacy Word binary formats (.doc) where feasible using File Block policies.
Patch Information
Microsoft has released a security update addressing CVE-2026-63528. Consult the Microsoft Security Update CVE-2026-63528 page for the specific build numbers and deployment channels applicable to your Office version.
Workarounds
- Enable and enforce Protected View for files from the internet, unsafe locations, and Outlook attachments via Group Policy.
- Configure Microsoft Office File Block settings to prevent opening of untrusted legacy Word document formats.
- Deliver user awareness reminders to avoid opening unsolicited Word documents until patches are deployed.
# Example Group Policy registry keys to enforce Protected View for Word
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
