CVE-2026-63519 – Microsoft Office Graphics Component Remote Code Execution Vulnerability

CVE-2026-63519 is a critical heap-based buffer overflow vulnerability in the Microsoft Office Graphics Component. An unauthorized attacker can potentially execute code by sending a specially crafted Office file and convincing a user to open it. The Preview Pane is also an attack vector. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVSS Score: 7.8.

SEVERITY: Critical.

THREAT:
The vulnerability creates a remote code execution risk through malicious Office content. Attack complexity is low and no privileges are required, although user interaction is required. Successful exploitation could allow attacker-controlled code to execute on the affected system.

EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY:
CVE-2026-63519 is caused by a heap-based buffer overflow (CWE-122) in the Microsoft Office Graphics Component. The CVSS attack vector is Local because exploitation requires code to be executed from the local machine, while “Remote Code Execution” describes the attacker being remote. An attacker can send a malicious Office file and persuade a user to open it; the Preview Pane can also serve as an attack vector. The vulnerability requires no privileges and has low attack complexity, but user interaction is required. Successful exploitation can result in arbitrary code execution with high confidentiality, integrity, and availability impact.

EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Office 2019 (32-bit and 64-bit), Office 365 for Mac, Office LTSC 2021 and 2024 (32-bit and 64-bit), and Office LTSC for Mac 2021 and 2024. Exploitation requires a malicious Office file and user interaction, with the Preview Pane also identified as an attack vector.

BUSINESS IMPACT:
Successful exploitation could enable unauthorized code execution on affected endpoints, potentially compromising sensitive information, altering data, and disrupting system availability. Because Office documents are routinely used in business workflows, a malicious document could create significant operational and security consequences.

WORKAROUND:
No mitigations or workarounds are identified. An official fix is identified as the remediation.

URGENCY:
This vulnerability is rated Critical and can result in remote code execution with high confidentiality, integrity, and availability impact. Organizations should prioritize deployment of the official fix across affected Microsoft Office installations, especially where users routinely process Office documents or use Preview Pane functionality.