CVE-2026-45461: Microsoft Office Use-After-Free Remote Code Execution Vulnerability

Technical summary

CVE-2026-45461 is a use-after-free vulnerability (CWE-416) combined with a buffer overflow issue (CWE-787) in Microsoft Office. The flaw exists in memory management within the Office application suite. When Office processes certain operations, it may reference memory that has already been freed, allowing an attacker to write to or execute from that memory region. This occurs in the local execution context without requiring elevated privileges or user interaction, making the attack surface broader than typical office-based vulnerabilities.

Business impact

This vulnerability poses a direct threat to any organization running Microsoft Office across their user base. Compromised systems could lead to data exfiltration, lateral movement to more critical assets, installation of persistent malware, and operational disruption. The high CVSS score reflects the severity: attackers with local access can achieve confidentiality, integrity, and availability compromise without needing admin rights. In shared computing environments, managed workstations, or scenarios where untrusted code execution is possible, exploitation risk escalates significantly.

Affected systems

Microsoft Office 2016, 2019, 2021, and 2024 are affected, as well as Microsoft 365 Apps and Microsoft 365 Copilot. Organizations running any of these versions—whether as standalone installs or through Microsoft 365 subscriptions—should prioritize assessment. The breadth of affected versions reflects Office's deep penetration across enterprises and means patching will require coordination across multiple deployment channels.

Exploitability

The vulnerability does not appear on CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no public evidence of active exploitation as of the latest update. However, the attack vector is local with low complexity and no privilege requirement. Once a working exploit is developed and shared, the barrier to weaponization is low. The lack of KEV status should not diminish urgency; a use-after-free in Office is an attractive target for threat actors given Office's ubiquity.

Remediation

Microsoft has released patches for affected Office versions. Organizations should verify the specific patch versions applicable to their deployed editions by consulting Microsoft's security advisory and MSRC (Microsoft Security Response Center) bulletin for CVE-2026-45461. Patching should be expedited given the HIGH severity and local attack vector. For Microsoft 365 Apps, patches are typically deployed automatically; verify that automatic updates are enabled and have completed. For Office 2016, 2019, and 2021 standalone installations, manual update deployment may be necessary.

Patch guidance

Contact Microsoft or review the official MSRC advisory for CVE-2026-45461 to identify the specific patched versions for your Office edition. Test patches in a controlled environment before broad rollout to avoid compatibility issues. For Microsoft 365 subscribers, ensure your tenant and client devices are on the latest build. For on-premises Office installations, use your standard change management and deployment tools (SCCM, Intune, Group Policy) to distribute patches. Prioritize user-facing workstations and shared machines where local access risk is highest.

Detection guidance

Monitor for use-after-free exploitation attempts through memory corruption signatures in your EDR/XDR platform. Look for Office applications generating unexpected crashes or exhibiting abnormal memory access patterns. Review process execution logs for Office spawning child processes (cmd.exe, powershell.exe) in contexts where that behavior is unusual. Behavioral indicators include Office processes attempting to allocate large memory regions or accessing memory addresses that deviate from normal application behavior. Endpoint Detection and Response (EDR) tools with memory forensics capabilities are particularly valuable for detecting this class of vulnerability.

Why prioritize this

This vulnerability merits immediate prioritization due to: (1) HIGH CVSS score (8.4) with full confidentiality, integrity, and availability impact; (2) no privilege escalation needed; (3) local attack vector that does not require social engineering or user interaction; (4) extremely broad product coverage spanning Office 2016 through 2024 plus Microsoft 365 suites; (5) absence from KEV catalog does not reduce risk—it reflects current status, not inherent safety. In environments with shared devices, remote desktop services, or containers where untrusted local code execution is possible, the threat is amplified.

Risk score, explained

The CVSS 3.1 score of 8.4 reflects: Attack Vector (Local) = more restricted than network but still applicable to many scenarios; Attack Complexity (Low) = the flaw is straightforward to trigger; Privileges Required (None) = no admin or special access needed; User Interaction (None) = no clicking, opening files, or tricking users; Scope (Unchanged) = impact is limited to the Office process and its context, not system-wide; Confidentiality/Integrity/Availability (all High) = the attacker can read sensitive data, modify files, and crash the application. The result is a HIGH severity vulnerability that demands urgent patching but is mitigated somewhat by the local-only attack vector.

Frequently asked questions