CVE-2026-45475: Microsoft Office Heap Buffer Overflow Local Code Execution

Technical summary

CVE-2026-45475 is a heap-based buffer overflow (CWE-122) in Microsoft Office affecting multiple product lines and versions. The vulnerability has a CVSS 3.1 score of 7.8 (HIGH) with a vector of CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The attack vector is local, requires no privileges to initiate, and demands only user interaction. The impact scope is unchanged but confidentiality, integrity, and availability are all fully compromised. The flaw resides in heap memory management within Office's document processing engine, allowing an attacker to corrupt memory structures and gain code execution in the context of the application.

Business impact

An attacker exploiting this vulnerability can steal sensitive information from Office documents, modify business-critical files, or use a compromised system as a pivot point into enterprise networks. Given Office's ubiquity in business environments, the potential blast radius is significant. Attackers could target knowledge workers with spear-phishing campaigns delivering weaponized documents, leading to data exfiltration, intellectual property theft, or lateral movement to backend systems. For organizations handling classified, regulated, or proprietary information, this poses a material compliance and operational risk.

Affected systems

The vulnerability affects Microsoft 365 Apps, Office 2016, Office 2019, Office 2021, Office 2024, and Microsoft 365 (which includes SharePoint Server in hybrid deployments). The broad version coverage means most organizations running Microsoft Office are potentially exposed. Verify your exact product SKUs and versions against the vendor advisory to confirm affected editions.

Exploitability

Exploitability is moderate in terms of attack complexity—the flaw requires local file system access and user action (opening a document)—but the barrier to weaponization is low. An attacker need only craft a malicious Office document and distribute it via email or file sharing. No network access is required, and the user does not need administrative privileges to trigger the overflow. Since no public exploits are currently tracked in CISA's KEV database, the risk of widespread automated attacks remains lower than for actively exploited vulnerabilities, but this should not be mistaken for low urgency given the ease of weaponization.

Remediation

Apply security updates from Microsoft immediately upon release. Microsoft typically bundles Office patches in monthly cumulative updates (Patch Tuesday). Organizations should prioritize deployment to machines handling sensitive data and those owned by high-value targets (executives, engineers, finance staff). For on-premises Office installations (2016, 2019, 2021, 2024), consult Microsoft's update guidance for your specific version. Microsoft 365 subscribers will receive updates automatically, but verify that auto-update policies are enabled. Until patches are applied, restrict document sharing from external sources and enforce mail gateway scanning for suspicious Office files.

Patch guidance

Monitor Microsoft's official security updates and advisories for CVE-2026-45475. Patches will vary by product line: Microsoft 365 Apps receives updates through the Update Channel you configure (Current Channel, Monthly Enterprise Channel, or Semi-Annual Enterprise Channel); traditional Office versions require KB article downloads or Windows Update. Test patches in a pilot environment before broad deployment to ensure compatibility with line-of-business add-ins and macros. Document your patching timeline and maintain records of patched versus unpatched systems for audit purposes.

Detection guidance

Monitor for Office process crashes, unexpected child process spawning from Office applications (winword.exe, excel.exe, powerpnt.exe, outlook.exe), and heap corruption indicators in event logs. Endpoint Detection and Response (EDR) solutions can flag suspicious memory access patterns or shellcode injection attempts targeting Office processes. Network-based detection is limited since the attack is local, but monitor email gateways for Office document attachments from untrusted senders. Consider blocking potentially dangerous file types or requiring user confirmation before opening documents from external sources.

Why prioritize this

This vulnerability warrants HIGH priority remediation because it combines high severity (7.8 CVSS) with broad product coverage and ease of weaponization. Local attacks often precede lateral movement in multi-stage breaches, making this an excellent initial foothold for persistent threats. The requirement for user interaction is low friction in a business environment where document sharing is routine. Although not yet in active exploitation (per KEV status), the attack surface is large and the impact is severe.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects the combination of local attack vector, low attack complexity, no privilege requirement, user interaction, and full compromise of confidentiality, integrity, and availability. The score does not incorporate threat intelligence (e.g., active exploitation or weaponization prevalence), which would elevate risk scoring in a real-world assessment. Organizations should layer detection and access controls to reduce the likelihood of user interaction with malicious documents.

Frequently asked questions