CVE-2026-63533

The 'local' qualifier in this CVE description masks the real attack surface. The code execution is local on the endpoint, but the delivery is remote—phishing a weaponized .docx or .xlsx file. The 'local' framing suggests physical or authenticated access is required, which fundamentally misrepresents how Office RCEs are actually exploited in practice. If the CVSS vector treated this as requiring user interaction only (opening a document), the 'local' language is misleading analysts about the actual threat model. The CVSS 7.8 score also warrants scrutiny. A heap overflow achieving arbitrary code execution in Office typically lands in the 8.8-9.8 range when exploitation constraints are minimal. The 7.8 suggests either heavy mitigations (ACG, CFG, sandboxing) are present, or exploitation constraints are substantial. But here's what the score obscures: Office doesn't run in isolation. A compromised Office process holds authentication tokens for Microsoft Graph, has hooks into SharePoint and Teams, and bridges to Azure AD. You don't need to lateral-move when the process you're inside already has trust relationships with everything else. The CVSS may be technically correct for the vulnerability in isolation, but it's blind to the cascade path into the broader Microsoft 365 ecosystem. The vulnerability class itself is telling. Heap overflows in Office document parsers have a documented lineage—they spike after parser feature additions, persist through 'legacy compatibility' exceptions, and decline temporarily as the security team audits that specific code path. If this overflow lives in abandoned parsing code that predates modern hardening—code removed from active maintenance rotation—then it may bypass the mitigations the rest of Office relies on. That's a fundamentally different vulnerability than one confined to a sandboxed Office process. What defenders should check: confirm the affected Office versions and whether they include modern hardening mitigations; verify whether this code path runs sandboxed or in a legacy process context; treat this as high-priority regardless of the CVSS score given the identity token exposure; and monitor for phishing delivery of Office documents as the primary attack vector, not 'local access' scenarios.

Reviewed through automated stages and approved by a human before publication.