CVE-2026-45474: Microsoft Office Remote Code Execution Vulnerability

Synopsis

Heap-based buffer overflow in Microsoft Office allows an attacker with local access to execute arbitrary code without any credentials or user interaction. The vulnerability is reached locally, meaning an attacker who already has a shell or process on the affected host can trigger the overflow directly. Successful exploitation gives the attacker full control over the process, enabling arbitrary code execution with high impact on confidentiality, integrity, and availability. A patched-image rebuild at version 16.0.5556.1005 (and equivalent Click-to-Run releases per the Microsoft Office Security Releases page) is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required to trigger the overflow.

• AuthenticationNot required

  No credentials or account are required; the overflow can be triggered by any process already running on the affected host.

• Victim interactionNot required

  No user action is needed to trigger the vulnerability once the attacker has local execution context.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout dependencies, or other environmental factors.

Blast Radius

• Attacker executes arbitrary code in the context of the affected Microsoft Office process, gaining the same privileges as the running application.
• All files and data accessible to the Office process can be read, including locally cached documents, credentials stored by Office integrations, and authentication tokens.
• Attacker can write or overwrite files accessible to the process, modifying documents, configuration, or data persisted on the host.
• The affected Office process can be crashed or forced into an unresponsive state, disrupting document processing or any pipeline stage that depends on Office components.