Stack-based buffer overflow in Microsoft Office

CVE-2026-63526 is a stack-based buffer overflow (CWE-121) in the Microsoft Office Graphics Component. Affected versions span the entire modern Office lineup: Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and the corresponding macOS editions (Office 365 for Mac, LTSC for Mac 2021/2024). A specially crafted Office document triggers the overflow when rendered by the Graphics Component. Critically, the Outlook Preview Pane is a confirmed attack vector, meaning a user does not need to deliberately open the file — merely selecting the email in Outlook or letting it render in the reading pane is sufficient to trigger exploitation.

Microsoft rates this HIGH at CVSS 7.8, and that score is accurate for the mechanics but slightly undersells the delivery risk. The CVSS vector marks UI:R (user interaction required), which technically is true — the user must preview or open the file — but Preview Pane interaction is so passive that it functionally approaches zero-click in default Outlook configurations. However, the lack of any known exploitation, the absence of public PoC code, and the strong modern exploit mitigations in current Office builds (ASLR, DEP, Control Flow Guard, /GS stack cookies) keep the real-world weaponization risk firmly in check *for now*. The vendor severity of HIGH is fair; we concur.

Why this verdict

• Preview Pane as attack vector effectively negates the UI:R friction in the CVSS vector. Default Outlook configurations render attachments on email selection, making this a passive-trigger exploit path via standard spear-phishing delivery.
• Massive installed base — Microsoft Office runs on virtually 100% of enterprise endpoints, meaning the reachable population for this vulnerability is the entire fleet. There is no 'only affects niche configurations' downgrade here.
• Role multiplier: Office endpoints span low-value (dev sandboxes), typical (standard workstations), and high-value roles (executive workstations with access to sensitive data, finance/legal endpoints). The blast radius per exploitation is single host at user privilege — not domain, fleet, or supply-chain. Office is not a DC, hypervisor, or identity provider; it is an initial-access surface. Compromise of a single workstation is serious but requires additional chain links (privesc + lateral movement) to reach domain-level impact. This keeps the verdict at HIGH, not CRITICAL.
• No exploitation or PoC — EPSS at 0.00348 and Microsoft's own 'Less Likely' assessment both indicate low near-term weaponization risk. Stack-based overflows against modern Office with /GS cookies, ASLR, DEP, and CFG are non-trivial to exploit reliably.
• Modern mitigations provide defense-in-depth — ASR rules, Defender for Office 365 Safe Attachments, Protected View, Application Guard, and EDR all create layers that must be bypassed for successful exploitation.

Why not higher?

CRITICAL requires either active exploitation, a trivially weaponizable PoC, or a blast radius that reaches domain/fleet/supply-chain level from a single exploitation. None of these conditions are met. The vulnerability yields user-level code execution on a workstation — significant, but not fleet-scale impact without additional exploit chains. The stack-based overflow class is harder to weaponize on modern Windows than heap corruption, and no attacker has demonstrated it can be done for this specific bug.

Why not lower?

The Preview Pane vector makes this realistically deliverable via email to every employee in the organization without requiring them to open a file. The affected population is the entire Office-installed base — there is no version or configuration narrowing. Even without a PoC today, the Office Graphics Component is a well-researched attack surface and history shows these bugs get weaponized within weeks to months. A MEDIUM rating would dangerously underweight the delivery ease and population breadth.

1. Disable Outlook Preview Pane via GPO — Set the HKCU\Software\Microsoft\Office\16.0\Outlook\Preferences\PreviewPane registry value or deploy via Group Policy to disable the reading pane. This eliminates the passive-trigger attack path. Deploy within 30 days per the noisgate mitigation SLA for HIGH.
2. Enable Attack Surface Reduction (ASR) rules for Office — Enable the ASR rules 'Block Office applications from creating child processes' (D4F940AB-401B-4EFC-AADC-AD5F3C50688A) and 'Block Office applications from injecting code into other processes'. These break most post-exploitation payloads even if the overflow is triggered. Should already be deployed; audit enforcement within 30 days.
3. Ensure Safe Attachments is enabled in Defender for Office 365 — Safe Attachments detonates Office files in a sandbox before delivery. This catches most malicious documents targeting rendering-stage vulnerabilities. Verify policy coverage across all mailboxes.
4. Enable Protected View and Application Guard for Office — Protected View opens externally sourced documents in a sandboxed read-only mode. Application Guard (if licensed) provides hardware-level isolation. Ensure neither is disabled by user or GPO exception.
5. Accelerate Click-to-Run channel updates — Microsoft 365 Apps on Current Channel will auto-patch. Ensure Semi-Annual Enterprise Channel or deferred update rings are not delaying this patch beyond 30 days.

Run on each target Windows endpoint with standard user privileges. Example: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-63526.ps1. For Mac endpoints, verify the Office version via Microsoft AutoUpdate > About against the August 2026 release.

# Check-CVE-2026-63526.ps1
# Checks whether Microsoft Office is patched for CVE-2026-63526 (August 2026 Patch Tuesday)
# Run on target Windows endpoint. No admin privileges required.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

$ErrorActionPreference = 'Stop'

function Get-OfficeVersion {
    # Check Click-to-Run first
    $c2rPath = 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration'
    if (Test-Path $c2rPath) {
        $ver = (Get-ItemProperty -Path $c2rPath -Name VersionToReport -ErrorAction SilentlyContinue).VersionToReport
        if ($ver) { return @{ Type = 'C2R'; Version = [version]$ver } }
    }
    # Check MSI-based Office 2016
    $msiPath = 'HKLM:\SOFTWARE\Microsoft\Office\16.0\Common\ProductVersion'
    if (Test-Path $msiPath) {
        $ver = (Get-ItemProperty -Path $msiPath -Name LastProduct -ErrorAction SilentlyContinue).LastProduct
        if ($ver) { return @{ Type = 'MSI'; Version = [version]$ver } }
    }
    # Fallback: check osgraph.dll directly
    $dllPaths = @(
        "$env:ProgramFiles\Microsoft Office\root\Office16\osgraph.dll",
        "${env:ProgramFiles(x86)}\Microsoft Office\root\Office16\osgraph.dll",
        "$env:ProgramFiles\Microsoft Office\Office16\osgraph.dll",
        "${env:ProgramFiles(x86)}\Microsoft Office\Office16\osgraph.dll"
    )
    foreach ($p in $dllPaths) {
        if (Test-Path $p) {
            $fv = (Get-Item $p).VersionInfo.FileVersion
            if ($fv) { return @{ Type = 'DLL'; Version = [version]$fv } }
        }
    }
    return $null
}

$office = Get-OfficeVersion
if (-not $office) {
    Write-Output 'UNKNOWN - Microsoft Office not detected on this system.'
    exit 2
}

$type = $office.Type
$ver = $office.Version
Write-Output "Detected Office ($type): $ver"

# August 2026 Patch Tuesday C2R builds (approximate; adjust per channel)
# Current Channel: 16.0.20000+ builds released after 2026-08-11
# The key threshold is the August 2026 security update build number.
$patchedC2R = [version]'16.0.20008.20000'
# MSI Office 2016 KB5002897 updates osgraph.dll to 16.0.5500.1000+
$patchedMSI = [version]'16.0.5500.1000'

switch ($type) {
    'C2R' {
        if ($ver -ge $patchedC2R) {
            Write-Output 'PATCHED - Office version includes August 2026 security updates.'
            exit 0
        } else {
            Write-Output 'VULNERABLE - Office version predates August 2026 security updates. Apply update immediately.'
            exit 1
        }
    }
    { $_ -in 'MSI','DLL' } {
        if ($ver -ge $patchedMSI) {
            Write-Output 'PATCHED - Office component version includes KB5002897 fix.'
            exit 0
        } else {
            Write-Output 'VULNERABLE - Office component version predates KB5002897. Install KB5002897.'
            exit 1
        }
    }
    default {
        Write-Output 'UNKNOWN - Could not determine patch status.'
        exit 2
    }
}

Sources

1. Microsoft MSRC - CVE-2026-63526
2. CrowdStrike - August 2026 Patch Tuesday Analysis
3. Cisco Talos - Microsoft Patch Tuesday August 2026
4. Action1 - Patch Tuesday August 2026
5. Microsoft Support - KB5002897 for Office 2016
6. ZeroPath - CVE-2025-30386 Office Preview Pane RCE (prior art)
7. CybersecurityNews - Critical Microsoft Office Vulnerabilities