CVE-2026-45486: Microsoft Office Word Use-After-Free RCE Vulnerability

Technical summary

CVE-2026-45486 is a use-after-free (CWE-416) memory safety vulnerability in Microsoft Word. The vulnerability exists in how Word handles certain document objects during parsing or rendering. When a specially crafted Office document is opened, Word may reference memory that has been freed, leading to a controlled code execution primitive. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects local attack surface, low complexity, requirement for user interaction, and complete compromise of confidentiality, integrity, and availability on the affected system.

Business impact

A successful exploit of this vulnerability could allow an attacker to assume full control of an affected user's workstation, including the ability to read sensitive files, modify business-critical documents, install persistent malware, or pivot to corporate network resources. For organizations heavily dependent on Microsoft Office, particularly those with remote or hybrid workforces handling untrusted documents, this poses a material risk to data confidentiality and business continuity. The reliance on user interaction (opening a malicious document) makes social engineering a likely attack vector.

Affected systems

Affected products include Microsoft 365 Apps, Office 2021, and Office 2024. The vulnerability affects both subscription-based Microsoft 365 installations and perpetual-license versions. Users of Word as a standalone application or as part of Microsoft 365 suites are in scope. Organizations managing multiple Office versions should inventory all affected installations across their environment.

Exploitability

While the vulnerability requires local access and user interaction to trigger, these constraints are not exceptionally high in practice. Malicious documents can be distributed via email, file-sharing services, or compromised websites. Once a user opens the document—a routine action in business environments—code execution occurs automatically without additional user prompting. The relatively low attack complexity and high impact make this an attractive target for adversaries. However, the absence of CVE-2026-45486 from the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date indicates active exploitation has not yet been publicly confirmed.

Remediation

Microsoft is expected to release security updates addressing this vulnerability. Organizations should apply patches to all affected Office installations as soon as they become available. Interim mitigations may include restricting document opening from untrusted sources, disabling macros in Office applications, and implementing application whitelisting to prevent unauthorized code execution. Verify patch availability and version numbers against official Microsoft security advisories and update channels.

Patch guidance

Monitor Microsoft's security update releases and official advisories for CVE-2026-45486 patch details. When patches become available, prioritize deployment to systems where Office is used by employees who handle external or untrusted documents. Consider phased rollout testing in a non-production environment first. Organizations using Microsoft 365 may receive automatic updates; verify that auto-update is enabled. For Office 2021 and 2024 perpetual licenses, manual updates or update management tools may be required depending on your deployment model.

Detection guidance

Endpoint detection and response (EDR) solutions should alert on unusual child process creation from Microsoft Word, particularly spawning system utilities (cmd.exe, powershell.exe) or loading suspicious DLLs. Monitor for abnormal memory access patterns within Word processes. Network-based indicators are limited due to the local nature of the vulnerability, but email gateways should flag Office documents with suspicious embedded objects or macro content. Log Office crashes or access violations, which may indicate exploitation attempts. Consider behavioral analysis to detect document-triggered code execution.

Why prioritize this

This vulnerability merits urgent remediation due to its HIGH severity rating, complete system compromise potential, and the ubiquity of Microsoft Office in enterprise environments. The requirement for user interaction is offset by the routine nature of opening documents in business workflows, making exploitation likelihood moderate to high. Organizations should prioritize patching within their standard patch management timelines, treating this as a High-priority fix rather than a lower-criticality security update.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects the high impact (confidentiality, integrity, and availability all compromised) balanced against the local attack vector and user interaction requirement. The use-after-free class of vulnerability (CWE-416) is well-understood by researchers and often enables reliable code execution once a triggering input is crafted. The combination of high exploitability within its constraint model and severe consequences results in a HIGH severity classification.

Frequently asked questions