CVE-2026-63532: Microsoft Office RCE Vulnerability

CVE-2026-63532 Overview

CVE-2026-63532 is a heap-based buffer overflow vulnerability in Microsoft Office triggered by an integer overflow or wraparound condition [CWE-122]. The flaw allows an unauthorized attacker to execute arbitrary code locally on a targeted system. Exploitation requires user interaction, typically through opening a crafted Office document. Microsoft published the advisory on August 11, 2026, and the issue carries a CVSS 3.1 score of 7.8. The vulnerability affects the local attack surface of Office and does not require prior authentication.

Critical Impact
Successful exploitation grants the attacker code execution in the context of the current user, enabling full compromise of confidentiality, integrity, and availability on the affected host.

Affected Products

Microsoft Office (refer to the Microsoft Security Response Center advisory for the specific product builds and channels)

Discovery Timeline

2026-08-11 - CVE-2026-63532 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-63532

Vulnerability Analysis

The vulnerability originates in Microsoft Office parsing logic that performs arithmetic on values derived from untrusted document content. When a size or length calculation overflows the range of its integer type, the result wraps to a small value. Office then allocates an undersized heap buffer based on that wrapped result. Subsequent copy operations use the original, larger length and write past the end of the allocation. This produces a classic heap-based buffer overflow that corrupts adjacent heap metadata and object pointers.

Attackers can shape the heap to place a controlled object next to the overflowing allocation. Overwriting virtual function pointers or object fields redirects execution to attacker-controlled data. The end result is arbitrary code execution in the context of the user running Office.

Root Cause

The root cause is an integer overflow leading to a heap allocation smaller than the data written into it. The condition is classified under [CWE-122] Heap-based Buffer Overflow. Missing bounds validation on document-supplied length or count fields allows the arithmetic to wrap silently.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious Office document through email, a web download, or a shared file location. The victim opens the file, and parsing of the crafted structure triggers the overflow. No network access to the target is required beyond delivery of the file. See the Microsoft CVE-2026-63532 Update advisory for vendor-specific technical detail.

Detection Methods for CVE-2026-63532

Indicators of Compromise

Office documents containing malformed embedded objects, oversized structural fields, or unusual OLE stream sizes that fail normal schema validation.
Child processes spawned by winword.exe, excel.exe, or powerpnt.exe such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Unexpected outbound network connections initiated by Office processes shortly after a document is opened.

Detection Strategies

Hunt for Office applications loading unsigned DLLs from user-writable directories such as %APPDATA% or %TEMP%.
Alert on Office process crashes with exception codes consistent with heap corruption (0xC0000374, 0xC0000005) followed by process respawn.
Correlate document open events with subsequent script interpreter execution or LOLBin activity within a short time window.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and log any triggers.
Forward Office telemetry, Sysmon process creation, and image load events to a central log store for retention and hunting.
Track document provenance using Mark-of-the-Web (MOTW) attributes and alert on macro or object activation from internet-sourced files.

How to Mitigate CVE-2026-63532

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-63532 Update advisory to all Office installations.
Prioritize patching for endpoints belonging to users who routinely receive external documents, including finance, HR, and executive assistants.
Verify update deployment through configuration management tooling and confirm the installed Office build matches the fixed version.

Patch Information

Microsoft has released a security update addressing CVE-2026-63532. Consult the Microsoft CVE-2026-63532 Update advisory for the specific KB articles, affected builds, and update channels applicable to your deployment.

Workarounds

Enable Protected View for documents originating from the internet, email attachments, and unsafe locations.
Configure Office to block macros in files from the internet and disable legacy file format parsing where business requirements allow.
Restrict opening of Office documents from untrusted sources using File Block policy and Group Policy Object (GPO) settings until patching is complete.

bash

# Configuration example
# Enforce Protected View and block internet macros via registry (Windows)
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security" /v BlockContentExecutionFromInternet /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security" /v BlockContentExecutionFromInternet /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security" /v BlockContentExecutionFromInternet /t REG_DWORD /d 1 /f