CVE-2026-45461: Microsoft Office Remote Code Execution Vulnerability

Synopsis

Heap-based buffer overflow in Microsoft Office allows an attacker with local access to execute arbitrary code on the affected system. The vulnerability is reached locally without any authentication or user interaction, and exploitation is reliable with no special conditions required. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected host. A patched-image rebuild at version 16.0.5556.1005 (and equivalent channel releases) is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationNot required

  No credentials or account are required to trigger the overflow; the attacker only needs the ability to run code or open a file locally.

• Victim interactionNot required

  The vulnerability can be triggered without any action from another user on the system.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, special memory layouts, or environmental dependencies are required.

Blast Radius

• Attacker executes arbitrary code in the context of the Office process, gaining the same privileges as the logged-in user.
• All files and data accessible to that user account can be read, including documents, credentials cached on disk, and browser profile data.
• The attacker can write or modify any files the user can access, including persisted Office documents and configuration files.
• The Office process and any dependent services can be crashed or made unavailable, disrupting productivity workflows on the host.