CVE-2026-63526 – Microsoft Office Graphics Component Remote Code Execution Vulnerability

CVE-2026-63526 is a critical remote code execution vulnerability caused by a stack-based buffer overflow in Microsoft Office. An attacker can send a specially crafted Office file and convince a user to open it; the Preview Pane is also an attack vector. Successful exploitation can execute code locally without requiring attacker privileges and can have a high impact on confidentiality, integrity, and availability.

CVSS Score: 7.8.

SEVERITY: Critical.

THREAT:
The vulnerability creates a remote code execution risk through malicious Office content. Attack complexity is low, privileges are not required, and user interaction is required. Although the attacker may deliver the malicious file remotely, exploitation executes code on the local machine.

EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY:
CVE-2026-63526 is a stack-based buffer overflow (CWE-121) in the Microsoft Office Graphics Component. A specially crafted Office file can trigger the vulnerability when processed locally. An attacker must send the malicious file and convince the user to open it, while the Preview Pane can also serve as an attack vector. No attacker privileges are required, attack complexity is low, and successful exploitation can execute unauthorized code with high confidentiality, integrity, and availability impact.

EXPLOITABILITY:
Affected products include 32-bit and 64-bit Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, Microsoft Office 365 for Mac, and Office LTSC for Mac 2021 and 2024. Exploitation requires malicious Office content to be processed locally, with user interaction required.

BUSINESS IMPACT:
Successful exploitation could allow unauthorized code execution and lead to exposure or modification of sensitive information and disruption of affected systems. Because Office documents are commonly exchanged in business environments, a malicious document could create significant risk when opened or processed through the Preview Pane.

WORKAROUND:
No mitigations or workarounds are specified. An official fix is identified, so affected Office installations should be updated where possible.

URGENCY:
This vulnerability is rated Critical and can result in remote code execution with high confidentiality, integrity, and availability impact. Organizations should prioritize deployment of the official fix across affected Microsoft Office products, particularly systems where users routinely handle externally sourced Office documents.