CVE-2026-63528 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office Word installations, particularly those in enterprise environments, should assess exposure and apply patches to prevent local information disclosure.

Why it matters

CVE-2026-63528 is a medium-severity vulnerability in Microsoft Office Word that allows local information disclosure via an out-of-bounds read. Defenders should assess exposure, apply patches, and monitor for unauthorized access to sensitive information.

• Defenders must assess exposure of Microsoft Office Word installations to CVE-2026-63528
• Apply patches from Microsoft for affected versions to prevent information disclosure
• Verify information disclosure risk for local attackers
• Monitor for unauthorized access to sensitive information

Technical summary

The Microsoft Office Word Information Disclosure Vulnerability (CVE-2026-63528) is caused by an out-of-bounds read in Microsoft Office Word, allowing an unauthorized attacker to disclose information locally. The vulnerability has a CVSS score of 5.5 and a medium severity level.

Defensive priority

Medium priority for defenders to assess exposure and apply patches

Recommended defensive actions

• Assess exposure of Microsoft Office Word installations to CVE-2026-63528
• Apply patches from Microsoft for affected versions
• Verify information disclosure risk for local attackers
• Monitor for unauthorized access to sensitive information

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but limited information is available on exploitation or impact. There is no evidence of public exploitation, but defenders should verify information disclosure risk for local attackers and monitor for unauthorized access to sensitive information. The official CVE Program record and NIST NVD detail page provide source-provided CVE metadata and vulnerability assessment. Vendor advisory and patch information is also being

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.