CVE-2026-45466: Heap Buffer Overflow in Microsoft Office Word—Risk Assessment & Patch Guidance

Technical summary

CVE-2026-45466 is a heap-based buffer overflow vulnerability (CWE-122) in Microsoft Office Word triggered through document parsing. The vulnerability permits information disclosure via memory read operations when processing a specially crafted Office document. The attack vector is local with no privileges required, but user interaction is mandatory. The CVSS 3.1 score of 3.3 (LOW) reflects the scope unchanged, absence of integrity or availability impact, and requirement for end-user action to materialize the risk.

Business impact

Organizations should assess exposure based on Word usage patterns and document handling practices. Since exploitation requires a user to open a malicious document, the practical risk depends on email filtering, user awareness, and whether sensitive data resides in memory during document processing. For environments with strong email controls and user training, the risk is mitigated. However, targeted spear-phishing campaigns could increase exposure for organizations handling classified or proprietary information that could be leaked through memory disclosure.

Affected systems

The vulnerability affects multiple Microsoft Office product lines: Microsoft 365 Apps, Microsoft Office 2021, and Microsoft Office 2024. The specific affected components include Word across these versions. Organizations should inventory Word deployments across these product families. This is not limited to a single release or patch level; verify against the vendor advisory for the exact affected build numbers and supported editions.

Exploitability

Practical exploitation is constrained by multiple factors. An attacker must craft a specially malicious Office document and then deliver it to a target user, requiring social engineering or spear-phishing. The user must then open the document in Word. Once triggered, the overflow occurs in the application's heap, potentially exposing sensitive data in memory—for example, recently accessed documents, clipboard contents, or encryption keys. However, weaponized exploit code is not known to be widely available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, reducing immediate threat severity.

Remediation

Microsoft has issued security updates addressing this vulnerability across affected product versions. Apply the latest security patches from Microsoft for Microsoft 365 Apps, Office 2021, and Office 2024 immediately. Organizations should prioritize patching in environments where users frequently open untrusted documents or receive email attachments. Concurrent defensive measures—including email gateway filtering, user security awareness training on phishing and malicious attachments, and network-based detection—further reduce risk while patches are deployed.

Patch guidance

Access Microsoft Update or the Microsoft 365 admin center and deploy the latest security patches for affected Word versions. For Office 2021 and Office 2024, patches are delivered through Windows Update or the Office update mechanism, depending on your deployment model. Verify the patch version in your Microsoft advisory documentation to confirm you are applying the correct security update. Test patches in a non-production environment first to ensure compatibility with your workflows and any add-ins. Deployment should be prioritized for high-risk user groups, followed by staged rollout to the broader organization.

Detection guidance

Monitor for unusual document parsing activity, heap corruption indicators, or abnormal process behavior when Word opens documents. Endpoint Detection and Response (EDR) tools can identify process memory anomalies or access patterns consistent with heap exploitation. Email security systems should flag Office documents with suspicious structural properties or embedded content. Log Word process crashes or memory access violations. User reports of unexpected memory access or slow document opening may indicate exploitation attempts. Network-based detection is limited since this is a local attack; focus on endpoint and email gateway controls.

Why prioritize this

Despite a LOW CVSS score, this vulnerability warrants prompt but not emergency response. The requirement for user interaction and local scope limits immediate organizational risk. However, the information disclosure impact means that targeted campaigns could expose sensitive data from users' systems. Organizations with high-value intellectual property, regulated data, or users targeted by advanced persistent threats should prioritize patches sooner. General enterprises can follow standard patch deployment schedules but should not defer indefinitely.

Risk score, explained

The CVSS 3.1 score of 3.3 reflects the combination of local-only attack surface (not network-exploitable), mandatory user interaction, absence of integrity and availability impacts, and confidentiality risk limited to information accessible in the vulnerable process's memory. The score is not a measure of business criticality; it is a technical baseline. Organizations handling sensitive information should apply their own risk rating framework to account for data sensitivity and exposure likelihood beyond the technical CVSS metric.

Frequently asked questions