CVE-2026-45645: Microsoft Office Untrusted Pointer Dereference RCE

Technical summary

The vulnerability stems from untrusted pointer dereference and improper bounds checking in Microsoft Office's document processing logic. When parsing specially crafted Office files, the application fails to validate pointer values before dereferencing them, resulting in an out-of-bounds write condition (CWE-787). Combined with insufficient pointer validation (CWE-822), this allows an attacker to overwrite adjacent memory regions and achieve arbitrary code execution in the context of the Office process.

Business impact

Organizations relying on Microsoft Office face risk of data theft, malware installation, and system compromise through weaponized documents. Since the attack requires only user action—opening a file—social engineering vectors become viable. Compromised endpoints could serve as footholds for lateral movement, particularly in environments where Office users access sensitive systems or maintain network privileges.

Affected systems

This vulnerability affects Microsoft 365 Apps, Office 2016, Office 2019, Office 2021, and Office 2024 across both retail and subscription-based deployments. All modern Office versions released in the past decade remain in scope, making this a broad exposure for most enterprises.

Exploitability

Exploitability is moderate to moderately-high. The attack requires local system access and user interaction (opening a document), which limits opportunistic exploitation. However, the barrier to weaponization is relatively low—crafted documents can be distributed via email or file-sharing services to target specific users. The lack of CISA KEV designation suggests exploitation in the wild is not yet confirmed, but the attack surface and user-centric delivery method make active exploitation likely over time.

Remediation

Apply security patches released by Microsoft for the affected Office versions. Organizations should prioritize patching Office 2016, 2019, 2021, and 2024 installations and Microsoft 365 Apps subscription services. Additionally, implement complementary controls: disable macros by default, block suspicious Office file types at email gateways, and enforce application whitelisting to limit code execution post-compromise.

Patch guidance

Verify patch availability through Microsoft's official security advisory channels and your organization's patch management system. For Microsoft 365 Apps, ensure automatic updates are enabled; for perpetual Office licenses (2016, 2019, 2021, 2024), obtain and deploy cumulative security updates from Windows Update or the Microsoft Update Catalog. Test patches in a non-production environment first to confirm compatibility with critical workflows.

Detection guidance

Monitor for anomalous Office process behavior: unexpected child process spawning, unusual network connections from Office processes, or suspicious memory writes. Endpoint Detection and Response (EDR) tools should flag attempts to execute code from Office temporary directories or suspicious API calls associated with memory manipulation. Network detection can identify malicious Office documents traversing email or file-sharing channels by examining document metadata and structure anomalies.

Why prioritize this

CVE-2026-45645 merits prompt attention due to its CVSS 7.8 (HIGH) rating, broad product coverage across Office generations, and reliance on user interaction that adversaries can facilitate through social engineering. While not yet in the CISA KEV catalog, the combination of high severity, mature attack surface, and ease of weaponization makes it a priority for patching within 30 days.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects high impact (confidentiality, integrity, and availability all compromised), local attack vector, low complexity, no privileges required, and required user interaction. The score appropriately captures the severity of arbitrary code execution balanced against the requirement for local access and social engineering to succeed.

Frequently asked questions