CVE-2026-45475: Microsoft Office Remote Code Execution Vulnerability

Synopsis

Heap-based buffer overflow in Microsoft Office allows an attacker to execute arbitrary code on a victim's machine. The vulnerability is triggered locally and requires no authentication, but does require the victim to open a specially crafted Office document. Successful exploitation gives the attacker full code execution with the privileges of the user running Office. A patched-image rebuild at the fixed versions is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no over-the-network vector is required.

• AuthenticationNot required

  No credentials or account access are required before triggering the vulnerability.

• Victim interactionRequired

  The victim must open a malicious Office document, making this a social-engineering vector that requires convincing the user to open a crafted file.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental prerequisites.

Blast Radius

• The attacker executes arbitrary code in the context of the user running Microsoft Office, inheriting that user's file system and network permissions.
• Confidential files accessible to the user (documents, credentials, session tokens) can be read and exfiltrated.
• The attacker can modify or delete files and data owned by the compromised user account.
• The Office process and any dependent services can be crashed or hijacked, disrupting the user's workload.