CVE-2026-44824: Microsoft Office Remote Code Execution Vulnerability

Synopsis

Heap-based buffer overflow in Microsoft Office allows an attacker to execute arbitrary code on the local machine. The vulnerability is triggered locally when a user opens or interacts with a malicious file, requiring no authentication but needing the victim to take that action. Successful exploitation gives the attacker full code execution in the context of the logged-in user, enabling data theft, file modification, or further system compromise. Patched-image rebuilds at versions 16.0.5556.1005, 16.0.10417.20153, and 16.0.19725.20384 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-exposed service is required to trigger this vulnerability.

• AuthenticationNot required

  No account or credentials are needed; the attacker only needs the ability to deliver a malicious file to the target system.

• Victim interactionRequired

  The victim must open or otherwise interact with a crafted Office document, making this a social-engineering-dependent exploit path.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim opens the file; no race conditions or specific memory layout requirements are noted.

Blast Radius

• Reads files and credentials accessible to the logged-in user, including stored Office documents, browser credential stores, and local configuration files.
• Modifies or deletes files on the local filesystem within the user's permission scope, including documents, scripts, and application data.
• Executes arbitrary processes under the victim's user context, enabling installation of malware, keyloggers, or lateral-movement tooling.
• Crashes or corrupts the Office application process, causing loss of unsaved work and potential data corruption in open files.