Stack-based buffer overflow in Microsoft Office for macOS and Microsoft Office - CVE-2026-63526

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to stack-based buffer overflow in the Microsoft Office graphics component when parsing a crafted Office file. A remote attacker can send a specially crafted Office file and convince the victim to open or preview it to execute arbitrary code.

The Preview Pane is an attack vector, and user interaction is required.

Affected software

How to mitigate CVE-2026-63526

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-63526
• https://www.microsoft.com/en-us/microsoft-365/mac/microsoft-365-for-mac?msockid=35f9adb0e74b61392038b90de6fe608c

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office