CVE-2026-63518

CVE-2026-63518 presents a heap-based buffer overflow in Microsoft Word with a 7.8 CVSS score but an EPSS of only 0.00359 — a gap that warrants closer inspection before defaulting to HIGH-priority remediation. The low EPSS likely reflects Microsoft's investment in post-exploitation mitigations rather than absence of the vulnerability. Modern Office deployments include Arbitrary Code Guard (ACG), Control Flow Guard (CFG), and heap hardening. These protections don't prevent the overflow, but they can transform successful exploitation into a process crash rather than arbitrary code execution. This means the CVSS score measures theoretical severity while EPSS reflects realistic exploitability in hardened environments — a predictable pattern for document parsing bugs in mature Microsoft products. What matters more than the CVE itself is the blast radius if exploitation succeeds. Word is a domain-joined application with cached OAuth tokens, SharePoint access, and MAPI credentials. An attacker who achieves code execution inside the Office process may not need to escape the sandbox — the process context already grants access to email, cloud resources, and identity tokens. The narrow exploitability and massive blast radius are not mutually exclusive. Before deprioritizing this CVE, verify your environment: check whether ACG and CFG are enabled for Office processes (they are by default in modern Windows but can be disabled by enterprise policy or in legacy VM configurations). Audit for legacy Office installations that may lack these protections. Review whether your organization runs any whitelisting configurations that permit unsigned macros — this is where the heap hardening becomes irrelevant. The 'local' attack vector in the CVSS vector (AV:L) means the attacker needs a user to open a crafted document on the target machine. This is a phishing or social engineering prerequisite, not remote code execution. If your organization has mature email filtering and user education around unexpected attachments, the actual risk surface is narrower than the CVSS suggests. Patch on your normal cycle, but prioritize user awareness training as a compensating control — the vulnerability exists precisely because someone will eventually open the file.

Reviewed through automated stages and approved by a human before publication.