365Fanatic / M365 Status / Security advisories / CVE-2026-63533

Microsoft Security Update Guide · Office / Microsoft 365 Apps

Microsoft Office Remote Code Execution Vulnerability

Microsoft · EN CVE-2026-63533 Important Action required CVSS 7.8

Published 11 aug 2026

Summary Detailed Security

What does this mean?

Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
CVSS 7.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office 365 for Mac: KBRelease Notes 16.112.26081010
- Microsoft 365 Apps for Enterprise for 32-bit Systems: KBClick to Run https://aka.ms/OfficeSecurityReleases
- Microsoft Office 2016 (64-bit edition): KB5002897 16.0.5565.1001
- Microsoft Office 2016 (32-bit edition): KB5002897 16.0.5565.1001
- Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.112.26081010
- Microsoft Office LTSC 2024 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases

Microsoft Office · Remote Code Execution

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

Office / Microsoft 365 Apps

How do I check if I am affected?

Update the app

Update the app through the App Store, Google Play or the app's own automatic updates.
If you manage devices with Intune, check in the Intune admin center which devices still run an older version.

What kind of flaw is this?

CWE-122: Heap-based Buffer Overflow
A heap buffer overflows, which can lead to running code.

Key facts

Released

11 aug 2026

Impact

Remote Code Execution

Max severity

Important

Weakness

CWE-122: Heap-based Buffer Overflow

CVSS 3.1

7.8 / 6.8 (base / temporal)

Vector string

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Publicly disclosed

Exploited

Exploitability assessment

Exploitation Less Likely

Customer action required

Yes

Links

Microsoft Security Update Guide · CVE.org

CVSS metrics

Base score metrics
Attack Vector	Local
Attack Complexity	Low
Privileges Required	None
User Interaction	Required
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	High
Temporal score metrics
Exploit Code Maturity	Unproven
Remediation Level	Official Fix
Report Confidence	Confirmed

Affected products and updates

Product	Update	Build
Microsoft Office 365 for Mac	KBRelease Notes · Security Update	`16.112.26081010`
Microsoft 365 Apps for Enterprise for 32-bit Systems	KBClick to Run	`https://aka.ms/OfficeSecurityReleases`
Microsoft Office 2016 (64-bit edition)	KB5002897 · Security Update	`16.0.5565.1001`
Microsoft Office 2016 (32-bit edition)	KB5002897 · Security Update	`16.0.5565.1001`
Microsoft Office LTSC for Mac 2024	KBRelease Notes · Security Update	`16.112.26081010`
Microsoft Office LTSC 2024 for 64-bit editions	KBClick to Run	`https://aka.ms/OfficeSecurityReleases`
Microsoft Office LTSC 2024 for 32-bit editions	KBClick to Run	`https://aka.ms/OfficeSecurityReleases`
Microsoft Office LTSC 2021 for 32-bit editions	KBClick to Run	`https://aka.ms/OfficeSecurityReleases`
Microsoft Office LTSC 2021 for 64-bit editions	KBClick to Run	`https://aka.ms/OfficeSecurityReleases`
Microsoft Office LTSC for Mac 2021	KBRelease Notes · Security Update	`16.112.26081010`
Microsoft 365 Apps for Enterprise for 64-bit Systems	KBClick to Run	`https://aka.ms/OfficeSecurityReleases`
Microsoft Office 2019 for 64-bit editions	KBClick to Run	`https://aka.ms/OfficeSecurityReleases`
Microsoft Office 2019 for 32-bit editions	KBClick to Run	`https://aka.ms/OfficeSecurityReleases`

FAQ

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?: An attacker must send a user a malicious Office file and convince them to open it.
According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?: The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability.
Is the Preview Pane an attack vector for this vulnerability?: Yes, the Preview Pane is an attack vector.

Revisions

Version	Date	Note
1	11 aug 2026	Information published.

What changed in Microsoft 365 this week? →

View at Microsoft → ← All security advisories

Source: Microsoft Security Update Guide. 365Fanatic is not affiliated with Microsoft.