CVE-2026-63521

The EPSS score of 0.00368 and CVSS 5.5 are sending a dangerous signal that you should push back on. An out-of-bounds read in Word's document parsing isn't just a crash or information leak in isolation — it's a primitives generator that can leak ASLR offsets, authentication tokens cached in process space, or snippets of recently-opened documents from a victim's machine. The 'local' qualifier matters less than the scoring suggests: a macro-embedded document sent via phishing, opened automatically in Word's protected view, still triggers the read. The CVSS scope metric being 'changed' tells you Microsoft acknowledges the attack surface is narrower than default — but 'local' in a document-driven attack surface is increasingly meaningless. What you should do: examine whether the patch modified bounds checking, pointer arithmetic, or index validation — each signals a different severity of underlying flaw. Ask whether the vulnerable code path lives in a specific format handler (RTF, legacy .doc, docx), because that determines which document vectors trigger the read and what memory regions become accessible. If this was found via fuzzing versus internal red-teaming, the discovery context materially changes the risk posture. The historical record is damning: information disclosure bugs in Office document parsers have repeatedly served as prerequisites in nation-state and ransomware chains (Emotet, TrickBot, Mustang Panda, the Sofacy cohort). The attack chain is inverted from what CVSS assumes — the document IS the primitive delivery mechanism, not a target requiring prior code execution. Microsoft has patched dozens of these identical CVSS vectors over fifteen years, and the pattern consistently shows quiet patches followed by reclassification after in-the-wild chains surface. Your priority: treat this as a high-severity information disclosure until proven otherwise. Monitor for indicators of the specific format handler being targeted. If your organization processes legacy document formats at scale, the blast radius extends beyond the endpoint to email, SharePoint, and cached credential stores that Word integrates with. The scoring frameworks weren't designed for document-chain exploitation — but the attackers were.

Reviewed through automated stages and approved by a human before publication.