CVE-2026-63533

HighCVSS 7.8/10Last modified Oct 14, 2026

Description

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

Vendor	Product	Versions
Microsoft	Microsoft 365 Apps for Enterprise	>= 16.0.1, < https://aka.ms/OfficeSecurityReleases
Microsoft	Microsoft Office 2016	>= 16.0.0, < 16.0.5565.1001
Microsoft	Microsoft Office 2019	>= 19.0.0, < https://aka.ms/OfficeSecurityReleases
Microsoft	Microsoft Office 365 for Mac	>= 1.0.0, < 16.112.26081010
Microsoft	Microsoft Office LTSC 2021	>= 16.0.1, < https://aka.ms/OfficeSecurityReleases
Microsoft	Microsoft Office LTSC 2024	>= 16.0.0, < https://aka.ms/OfficeSecurityReleases
Microsoft	Microsoft Office LTSC for Mac 2021	>= 16.0.1, < 16.112.26081010
Microsoft	Microsoft Office LTSC for Mac 2024	>= 16.0.0, < 16.112.26081010

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63533Vendor Advisory

Timeline

Published: Aug 11, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-635406.9Heap-based buffer overflow for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unpriv CVE-2026-635452.4Sharp and Toshiba Tec MFPs (multifunction printers) caches data internally when printing, and leave them uncleared. They may be accessed lat CVE-2026-63556.5A vulnerability in the web application allows unauthorized users to access and manipulate sensitive data across different tenants by exploit CVE-2026-635506.5The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted CVE-2026-635597.5An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to read out-of-bounds h CVE-2026-63569.6A vulnerability in the web application allows standard users to escalate their privileges to those of a super administrator through paramete CVE-2026-635636.5Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication feature disabled in CVE-2026-635667.5Memory allocation with excessive size value in the DTLS handshake reassembly (DtlsReliableHandshake, DtlsReassembler) in Legion of the Bounc CVE-2026-635677.5Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has CVE-2026-635687.5Allocation of resources without limits or throttling in the CMP/CRMF password-based MAC verifier (PKMacBuilder) in Legion of the Bouncy Cast CVE-2026-635696.5Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legion of the Bouncy Castle Inc. bc-csharp b CVE-2026-63575.3pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python