CVE-2026-45457: Microsoft Office Word Out-of-Bounds Read Remote Code Execution

Technical summary

CVE-2026-45457 is an out-of-bounds read vulnerability (CWE-125) in Microsoft Office Word that enables arbitrary code execution with local attack vector. The CVSS 3.1 score of 7.8 (HIGH) reflects a low attack complexity and no privilege requirement, but requires user interaction to open a malicious document. The vulnerability resides in Word's document parsing logic, where insufficient bounds checking on memory access allows an attacker to read beyond allocated buffer regions and ultimately achieve code execution in the context of the logged-in user.

Business impact

This vulnerability poses a direct risk to any organization where users work with Word documents from untrusted or semi-trusted sources. Successful exploitation results in complete system compromise under the user's privilege level. In environments handling sensitive intellectual property, customer data, or financial records, this could lead to data exfiltration, regulatory violations, and operational disruption. Remote work scenarios increase exposure, as users may be less cautious opening documents from email or file-sharing services.

Affected systems

Confirmed affected products include Microsoft 365 Apps, Microsoft 365 (the subscription service), Office 2021, and Office 2024. Any organization using these versions is potentially at risk. On-premises deployments of Office 2021 and 2024, as well as cloud-based Microsoft 365 subscriptions, require patching. Verify the exact patch status in your environment against the Microsoft security advisory.

Exploitability

Exploitation requires local access and user action—specifically, the user must open a malicious Word document. There is no remote exploitation vector and no requirement for elevated privileges beforehand. The attack relies on social engineering to deliver the document. As of the vulnerability publication date, there is no evidence of active exploitation in the wild (KEV status: not listed), but the relatively low barrier to initial compromise and high impact make this an attractive target for threat actors once patches lag in real-world environments.

Remediation

Organizations should prioritize patching affected Microsoft Office products as soon as vendor updates become available. Verify patch availability and version numbers through the official Microsoft Security Update Guide. In parallel, implement compensating controls: restrict document opening from untrusted sources, use macroless templates where possible, disable automatic content download, and enforce user awareness training on opening unexpected attachments. For high-risk users, consider disabling legacy document formats or using document conversion workflows.

Patch guidance

Monitor the Microsoft Security Update Guide (portal.msrc.microsoft.com) for patches addressing CVE-2026-45457 across all affected product lines. Patches will likely be released in monthly cumulative updates or out-of-band advisories. Test patches in a non-production environment before broad rollout, particularly in Microsoft 365 environments where automatic updates may be configured. For Office 2021 and 2024 on-premises, coordinate patch deployment with your change management process. Verify successful patch application by confirming the updated Office build version matches the advisory guidance.

Detection guidance

Monitor for suspicious Word document access patterns, particularly opens from temporary, download, or email staging directories. Endpoint Detection & Response (EDR) tools should flag unexpected code execution spawned from WINWORD.EXE or child processes attempting to access system resources, write to HKEY_LOCAL_MACHINE, or execute scripts. Inspect network traffic for unusual outbound connections immediately following document opens. Log all successful and failed document opens in security information and event management (SIEM) systems. Watch for phishing campaigns delivering weaponized .docx files, and correlate document metadata (sender, timestamps, file hashes) across your organization to identify targeted attacks.

Why prioritize this

Despite a lack of current KEV listing, this vulnerability merits immediate prioritization due to its HIGH CVSS score, low attack complexity, and prevalence of Microsoft Office in enterprise environments. The requirement for user interaction, while a limiting factor, is routinely overcome through social engineering. The breadth of affected products—spanning both subscription and perpetual Office licenses—means patch coordination is complex. Organizations should treat this as urgent and allocate resources to testing and deployment within 2–4 weeks of patch availability.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: local attack vector (AV:L) limiting initial compromise scope; low attack complexity (AC:L) making exploitation straightforward once a malicious document reaches the user; no privilege escalation required (PR:N); user interaction needed (UI:R) to open the document; impact confined to the user's context (S:U); and full compromise across confidentiality, integrity, and availability (C:H, I:H, A:H). The HIGH severity is justified by the combination of ease of exploitation and complete system control upon success. The absence of network-based attack vectors prevents a CRITICAL score.

Frequently asked questions