CVE-2026-45643: Microsoft Word Remote Code Execution Vulnerability

Synopsis

An untrusted pointer dereference vulnerability in Microsoft Word allows an attacker to execute arbitrary code on a target machine. Based on the CVSS vector (AV:L/PR:N/UI:R), exploitation is local and requires no authentication but does require the victim to open a malicious Word document. Successful exploitation gives the attacker full code execution with the victim's privileges, enabling complete confidentiality, integrity, and availability compromise of the affected system. A patched-image rebuild is available on HarborGuard for environments running affected versions of Microsoft 365 Apps for Enterprise, Office LTSC 2021, or Office LTSC 2024.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing service exposure is required to trigger this vulnerability.

• AuthenticationNot required

  No account credentials or prior authentication are required; the attacker can be a completely unprivileged local or social-engineering-delivered actor.

• Victim interactionRequired

  The victim must open a specially crafted Word document, making this a social-engineering-dependent exploit typically delivered via phishing or malicious file share.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout assumptions, or other environmental preconditions beyond the victim opening the file.

Blast Radius

• Reads files and secrets accessible to the victim user process, including stored credentials, documents, and session tokens.
• Modifies or deletes files on the local filesystem within the victim's permission scope.
• Crashes or destabilizes the affected Office process and any dependent workflows.
• Provides a foothold for lateral movement or privilege escalation from the compromised user context.