Heap-based buffer overflow in Microsoft Office for macOS - CVE-2026-63519

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in the Microsoft Office graphics component when parsing a crafted Office file. A remote attacker can send a specially crafted Office file and convince the victim to open it to execute arbitrary code.

The Preview Pane is also an attack vector, and user interaction is required.

Affected software

How to mitigate CVE-2026-63519

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-63519
• https://www.microsoft.com/en-us/microsoft-365/mac/microsoft-365-for-mac?msockid=35f9adb0e74b61392038b90de6fe608c

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office