CVE-2026-45463: Microsoft Office Remote Code Execution Vulnerability

Synopsis

Heap-based buffer overflow in Microsoft Office allows an attacker with local access to execute arbitrary code on the affected system. The vulnerability is reached locally without authentication or user interaction, as described by the CVSS vector (AV:L/PR:N/UI:N). Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected system. A patched-image rebuild at version 16.0.5556.1005 (and equivalent channel releases) is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the vulnerable service is required.

• AuthenticationNot required

  No account or credential is needed to trigger the overflow; the attacker requires only local execution capability.

• Victim interactionNot required

  No user action such as opening a file or clicking a link is required for exploitation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental pre-conditions beyond local access.

Blast Radius

• Reads any file accessible to the Office process, including stored credentials, documents, and application data.
• Writes or modifies files and registry entries accessible to the process, enabling persistence or data tampering.
• Crashes or destabilizes the affected Office application or dependent services, disrupting availability.
• Executes arbitrary code in the context of the running user, which on a typical enterprise desktop may carry broad local privileges.