Integer overflow in Microsoft Office for macOS and Microsoft Office - CVE-2026-63532

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to integer overflow or wraparound in Microsoft Office for macOS when parsing a specially crafted Office file. A remote attacker can send a specially crafted file to the victim and convince them to open it to execute arbitrary code.

User interaction is required to open the crafted file, and the Preview Pane is also an attack vector.

Affected software

How to mitigate CVE-2026-63532

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-63532
• https://go.microsoft.com/fwlink/p/?linkid=831049

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office