CVE-2026-45456: Microsoft Outlook and Word Remote Code Execution Vulnerability

Synopsis

A type confusion vulnerability in Microsoft Office (including Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, and SharePoint Enterprise Server 2016) allows an attacker with an existing foothold on the host to execute arbitrary code locally. The CVSS vector shows no network exposure and no authentication requirement, meaning the attacker exploits a malformed file or in-process operation that triggers the type mismatch directly on the machine. Successful exploitation gives the attacker full code execution with the ability to read, modify, or destroy data and crash the affected application. Patched-image rebuilds at the applicable fix versions are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attack vector is Local (AV:L), so the attacker needs an existing shell or process on the host rather than any network path to the service.

• AuthenticationNot required

  No privileges are required (PR:N), meaning the attacker does not need any account or credential on the target system.

• Victim interactionNot required

  No user interaction is required (UI:N), so the attacker does not need to socially engineer a victim into opening a file or clicking a link.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• The attacker executes arbitrary code in the context of the Office process, reading any files or secrets accessible to that process, including locally cached credentials and document contents.
• The attacker modifies or overwrites files and data accessible to the compromised process, including documents, templates, and application data on the host.
• The attacker terminates or crashes the affected Office application, disrupting availability for the user session.
• Because all three CVSS impact scores are High (C:H/I:H/A:H), the attacker achieves full control over the confidentiality, integrity, and availability of resources within the process scope.