CVE-2026-45471: Microsoft Word Remote Code Execution Vulnerability

Synopsis

An untrusted pointer dereference vulnerability in Microsoft Word allows an attacker to execute arbitrary code on the local machine. The attack is launched locally and requires no prior authentication, but the victim must open a specially crafted document. Successful exploitation gives the attacker full code execution on the affected system. Patched-image rebuilds at the fixed versions are available on HarborGuard for environments running affected versions of Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, and SharePoint Enterprise Server 2016.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required to reach the vulnerable code path.

• AuthenticationNot required

  No account credentials or prior authentication are needed to trigger the vulnerability.

• Victim interactionRequired

  The victim must open a specially crafted Word document, making this a social-engineering vector that requires user action.

• Attack complexityDetail

  Exploit conditions are reliable and condition-free; no race conditions or specific memory layout dependencies are required.

Blast Radius

• The attacker executes arbitrary code in the context of the user running Microsoft Word, gaining full control over that process.
• All files and data accessible to the victim user account can be read or exfiltrated.
• The attacker can modify or delete files, registry entries, and other persisted data accessible to the victim user.
• The attacker can crash or hijack the affected application and, depending on the user's privilege level, escalate further into the host OS.