CVE-2026-44819: Microsoft Office Remote Code Execution Vulnerability

Synopsis

Heap-based buffer overflow in Microsoft Office allows an attacker to execute arbitrary code on the local machine. The vulnerability is triggered locally and requires no authentication, but the attacker must convince a user to open a malicious file (for example, a crafted Office document). Successful exploitation gives the attacker full code execution in the context of the victim user, enabling complete confidentiality, integrity, and availability impact on the affected system. Patched-image rebuilds at versions 16.0.5556.1005 and the releases listed at https://aka.ms/OfficeSecurityReleases are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing service is required to reach the vulnerable code path.

• AuthenticationNot required

  No account or credentials are required prior to triggering the vulnerability.

• Victim interactionRequired

  A user must open or interact with a malicious Office document for the overflow to be triggered, making social engineering the primary delivery vector.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special environmental conditions or race-condition timing on the attacker.

Blast Radius

• Executes arbitrary code in the context of the victim user, giving the attacker full control of the user's session and accessible resources.
• Reads files, credentials, and any data the victim user can access on the host.
• Modifies or deletes files and persisted data within the victim user's permissions.
• Terminates or disrupts Office processes and any dependent workflows running under that user account.