CVE-2026-45472: Microsoft Office Remote Code Execution Vulnerability

Synopsis

Heap-based buffer overflow in Microsoft Office allows an attacker with local access to execute arbitrary code without any authentication or user interaction. The vulnerability is reachable locally, meaning the attacker must already have a process or shell on the affected host, and no privileges are required to trigger the overflow. Successful exploitation gives the attacker full control over the affected process, enabling arbitrary code execution with the permissions of the running Office application. A patched-image rebuild at version 16.0.5556.1005 (and equivalent channel releases) is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing exposure is required to trigger the vulnerability.

• AuthenticationNot required

  No account or credentials are required; the overflow can be triggered by any unprivileged local process.

• Victim interactionNot required

  No user action is needed to trigger the overflow once the attacker has local code execution on the host.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race conditions, or memory-layout knowledge.

Blast Radius

• The attacker executes arbitrary code in the context of the Microsoft Office process, gaining the same file system and memory permissions as the running application.
• Confidential data accessible to the Office process, including open documents, cached credentials, and locally stored files, is exposed to the attacker.
• The attacker can modify or delete files, documents, and application state that the Office process has write access to.
• The Office process can be crashed or made to behave arbitrarily, disrupting availability of the application for the affected user session.