CVE-2026-63515 – Microsoft Office Remote Code Execution Vulnerability

CVE-2026-63515 is a critical remote code execution vulnerability affecting multiple Microsoft Office products. The issue involves an out-of-bounds read and integer underflow. An unauthorized attacker can send a malicious Office file and convince a user to open it, resulting in code execution on the local machine. The Preview Pane is also identified as an attack vector.

CVSS Score: 7.8.

SEVERITY: Critical.

THREAT:
Successful exploitation can allow attacker-controlled code to execute locally with high impact to confidentiality, integrity, and availability. Attack complexity is low, no privileges are required, and user interaction is required. The Preview Pane can also serve as an attack vector.

EXPLOITS:
The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is Unproven, and the exploitability assessment is Exploitation Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified in the source information.

TECHNICAL SUMMARY:
CVE-2026-63515 is caused by out-of-bounds read and integer underflow conditions in Microsoft Office, identified as CWE-125 and CWE-191. A crafted malicious Office file can trigger the vulnerability and lead to local arbitrary code execution. Although the vulnerability is titled remote code execution because the attacker can be remote, exploitation itself occurs locally. An attacker can send a malicious Office document to a target and convince the user to open it. The Preview Pane is also an attack vector. Successful exploitation can have high confidentiality, integrity, and availability impact.

EXPLOITABILITY:
Affected products include 32-bit and 64-bit editions of Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office LTSC 2021, and Office LTSC 2024, as well as Microsoft Office 365 for Mac and Office LTSC for Mac 2021 and 2024. Exploitation requires no privileges but does require user interaction.

BUSINESS IMPACT:
Successful exploitation could enable unauthorized code execution and cause serious compromise of affected Office environments. The high confidentiality, integrity, and availability impacts mean an attack could expose sensitive information, alter data, or disrupt systems. A malicious document can therefore become a direct path from user interaction to system compromise.

WORKAROUND:
No workaround or mitigation is identified. An official fix is available, making patch deployment the documented remediation.

URGENCY:
This vulnerability is rated Critical and carries a CVSS base score of 7.8. Its low attack complexity, lack of required privileges, malicious-file attack path, and potential for high confidentiality, integrity, and availability impact make timely deployment important. Although exploitation is assessed as less likely and no exploitation is reported, affected Office installations should receive the official fix as a priority.