CVE-2026-45643: Microsoft Office Word Pointer Dereference RCE Vulnerability

Technical summary

CVE-2026-45643 is a pointer dereference vulnerability (CWE-822) in Microsoft Office Word. The vulnerability stems from insufficient validation of pointer references when processing document content. An attacker can craft a malicious Office document that, when opened by a user, causes Word to dereference an attacker-controlled pointer, leading to arbitrary code execution in the context of the user running Word. The low attack complexity and requirement for user interaction (opening a document) make this a practical attack vector in phishing or drive-by download scenarios.

Business impact

This vulnerability poses a significant risk to organizations where Office documents are regularly exchanged, particularly for sectors handling sensitive data. Compromised endpoints can lead to lateral movement, data exfiltration, or deployment of secondary malware. The requirement for user interaction means security awareness training and email gateway controls are critical mitigations. In supply-chain scenarios, trusted contacts sending malicious documents could bypass traditional perimeter defenses. Organizations should treat this as a high-priority threat requiring rapid remediation.

Affected systems

The vulnerability affects Microsoft Office 2021, Microsoft Office 2024, and Microsoft 365 Apps across all supported platforms where Word is deployed. Both subscription-based (Microsoft 365) and perpetual-license (Office 2021/2024) installations are vulnerable. Organizations should verify exact patched version availability from Microsoft's official security bulletins, as patch timelines may vary by product variant and update channel.

Exploitability

Exploitation requires creating a malicious Office document and delivering it to a target user, then relying on the user to open it. No special system privileges are needed on the attacker side, and the attack succeeds against standard user accounts. The CVSS vector (AV:L/AC:L/PR:N/UI:R) reflects that while local access and user interaction are required, the barriers to exploitation are low. Active exploitation is not currently reported in the KEV catalog, but the technical simplicity suggests a moderate risk of public exploitation once proof-of-concept details circulate.

Remediation

Apply security updates from Microsoft addressing CVE-2026-45643 to all affected Office and Microsoft 365 Apps installations. Organizations using Microsoft 365 Apps with automatic updates should confirm deployments have completed. Those on Office 2021 or 2024 should consult Microsoft's security update guidance for patch version numbers and KB article references. Interim measures include disabling macros by default, blocking Office documents from untrusted senders at the email gateway, and enforcing application whitelisting on high-risk systems.

Patch guidance

Check Microsoft's official security advisories and update portals for the specific patched version numbers for your Office product and version. Microsoft 365 Apps users should verify automatic updates have deployed; manual checks can be performed via File > Account > Update Options. Office 2021 and Office 2024 users must obtain patches through Windows Update or the Microsoft Download Center. Test patches in a non-production environment first, particularly if your organization uses Office add-ins or legacy macros that may be affected.

Detection guidance

Monitor for Word process crashes or unexpected termination when processing documents from untrusted sources. Endpoint detection and response (EDR) solutions should flag unusual memory access patterns, pointer dereference anomalies, or suspicious process spawning from winword.exe. Email security systems should scan for known malicious document signatures and apply sandboxing to high-risk attachments. Organizations using Windows Defender or third-party antivirus should ensure signature databases are current. Log failed document open events and crashes for forensic analysis.

Why prioritize this

A CVSS score of 7.8 (HIGH) combined with the document-based attack vector means this vulnerability should be remediated ahead of lower-severity issues. The lack of KEV listing does not minimize urgency; it reflects the current state as of the publication date and may change. The human element (user interaction) is a weakness in the attack chain, making user education valuable alongside patching. Organizations with strong email controls and security-aware users face lower risk than those with weak perimeter defenses.

Risk score, explained

The 7.8 CVSS score reflects a high-severity local code execution vulnerability with low attack complexity and no privilege requirements. The High impact rating covers confidentiality, integrity, and availability—an attacker executing code can read files, modify data, or disable systems. The requirement for local access and user interaction prevents a Critical rating. For most organizations, this maps to a high-priority patch window measured in days to weeks, not months.

Frequently asked questions