CVE-2026-63517

The CVSS 5.5 framing and 'local access required' language will cause you to deprioritize this, but out-of-bounds reads in Office are rarely standalone threats — they function as memory harvesters that enable downstream attacks, and the file-based delivery mechanism makes the 'local' constraint practically irrelevant. Microsoft Office processes untrusted input constantly — email attachments, downloaded documents, web-originated files — and does so with user implicit consent. The 'local attacker' qualifier in this CVE masks the actual threat model: an attacker doesn't need network access or authentication if they can get a malicious file opened. The out-of-bounds read itself may not execute code, but in a complex application like Office with decades of native interop code, encryption libraries, credential caches, and macro runtimes resident in memory, even modest information disclosure becomes a staging point for privilege escalation or session hijacking. Push hard on two questions that the CVE description leaves unanswered. First: what memory regions does this out-of-bounds read actually expose, and does the vulnerability allow targeted reads (allowing an attacker to extract specific credentials or tokens) or only incidental leakage from a bad pointer? Leaking heap metadata versus extracting an authentication token from a prior session represent wildly different risk profiles. Second: what was the reproduction case — was this triggered by file ingestion on a server process, a desktop preview pane, or did it require actual user interaction with a document open dialog? The answer determines whether your email gateway or collaboration server is in the blast radius, not just the endpoint. This vulnerability class isn't a one-off defect — it's a recurring genotype across decades of file format compatibility pressure. Each generation mutates the delivery mechanism and the specific parser entry point, but the underlying memory safety failure — the bounds-checking debt accumulated across decades — remains genetically continuous. The CVSS 5.5 score isn't just inaccurate; it's actively dangerous because information disclosure primitives in memory-resident applications gain value over time. Every unpatched hour, the Office process heap accumulates new credential fragments, session tokens, macro-authored content, and parsed document metadata. A medium-severity score grants explicit permission to delay remediation, systematically extending the window where this memory harvester operates against an increasingly rich target environment. The urgency isn't in the CVE severity — it's in the temporal gap between patch release and deployment.

Reviewed through automated stages and approved by a human before publication.