CVE-2026-45463: Integer Underflow in Microsoft Office Enables Local Code Execution

Technical summary

An integer underflow vulnerability (CWE-191) exists in Microsoft Office, compounded by potential memory corruption issues (CWE-121). When Microsoft Office processes specially crafted input, a numerical value can underflow, wrapping around to an extremely large number. This corrupts adjacent memory regions, allowing an attacker to overwrite critical data structures or inject malicious instructions. The vulnerability is triggered locally without requiring user privileges (PR:N) or user interaction (UI:N), and impacts the confidentiality, integrity, and availability of the affected system (C:H/I:H/A:H).

Business impact

This vulnerability poses a significant risk to organizations deploying Microsoft Office across their environment. An attacker with local system access—whether through compromised credentials, physical access, or lateral movement within a network—can execute arbitrary code with the same privileges as the user running Office. This enables theft of sensitive documents, installation of persistent malware, lateral network compromise, and operational disruption. Organizations relying on Office for business-critical workflows should prioritize immediate assessment and patching.

Affected systems

Microsoft 365 Apps, Microsoft 365 Copilot, Microsoft 365, Office 2016, Office 2019, Office 2021, and Office 2024 are affected. The vulnerability spans both subscription-based (Microsoft 365) and perpetual-license Office editions, making it broadly applicable across enterprise and consumer deployments. Verify your specific Office version and update status against the vendor's advisory.

Exploitability

The vulnerability requires local access to the target system, which limits exposure in fully remote work environments but remains a significant risk for hybrid or on-premises settings. No user interaction is required—an attacker can exploit it automatically upon system access. No publicly disclosed exploit code exists as of the advisory date, though the straightforward nature of integer underflow vulnerabilities suggests exploitation is feasible for a capable threat actor. Organizations should assume this will be weaponized if left unpatched.

Remediation

Apply the latest security updates from Microsoft as soon as practical. Microsoft has released patches across all affected Office versions; consult the official Microsoft Security Response Center (MSRC) advisory for version-specific patch numbers and download links. For organizations unable to patch immediately, restrict local system access through strong access controls, network segmentation, and monitoring.

Patch guidance

Obtain patches through Windows Update, Microsoft Update, or the Microsoft Download Center, depending on your Office deployment model. Microsoft 365 subscribers typically receive patches automatically; verify that auto-update is enabled. Organizations managing Office 2016, 2019, 2021, or 2024 should download patches from the vendor's security advisory and validate successful installation across all affected systems. Test patches in a non-production environment before broad deployment to ensure compatibility with business-critical workflows.

Detection guidance

Monitor systems for signs of suspicious local process execution or unexpected code execution from Office applications. Endpoint Detection and Response (EDR) solutions should flag unusual memory access patterns or shellcode-like activity originating from Office processes. Log and alert on failed Office operations or crashes that may indicate exploitation attempts. Organizations should also audit local system access logs to identify which accounts have accessed at-risk Office installations, particularly in the period before patching.

Why prioritize this

This vulnerability merits immediate attention because it combines high severity (CVSS 8.4), broad product impact across Office 2016–2024 and Microsoft 365, and the absence of privilege or interaction requirements. The high integrity and confidentiality impact means attackers can steal data or establish persistence. While the local-access requirement provides some boundary, the ease of initial compromise through phishing or credential theft makes this a meaningful risk. Organizations should prioritize patching over other lower-severity work.

Risk score, explained

The CVSS 3.1 score of 8.4 reflects the combination of local attack vector, low attack complexity, no privilege requirement, no user interaction needed, and high impact across confidentiality, integrity, and availability. The vulnerability does not allow lateral network attacks directly, and it does not affect system availability globally—only the compromised instance—which prevents a perfect 9.8 rating. Nevertheless, the score accurately captures a dangerous flaw that can lead to complete system compromise by a local attacker.

Frequently asked questions