CVE-2026-45458: Microsoft Outlook and Word Remote Code Execution Vulnerability

Synopsis

A type confusion vulnerability in Microsoft Outlook and Word (part of Microsoft Office and Microsoft 365 Apps) allows an unauthenticated attacker with local access to execute arbitrary code on the affected system. The flaw is triggered locally without any user interaction or elevated privileges, meaning any process or shell access to the host is sufficient to reach the vulnerable code path. Successful exploitation gives the attacker full control over the confidentiality, integrity, and availability of the affected system. Patched-image rebuilds at versions 16.0.5556.1000, 16.0.5556.1005, 16.0.10417.20153, and 16.0.19725.20384 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required to reach the vulnerable code path.

• AuthenticationNot required

  No credentials or account of any privilege level are required to trigger the type confusion flaw.

• Victim interactionNot required

  The vulnerability can be triggered without any action from a logged-in user or other victim on the system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Reads all files and data accessible to the Office process, including stored credentials, documents, and cached session tokens.
• Modifies or overwrites files and application data on the host, including Office configuration and persisted user data.
• Crashes or terminates the affected Office application or dependent services, disrupting availability for the local user.
• Executes arbitrary code in the security context of the vulnerable process, enabling further lateral movement or persistence on the host.