CVE-2026-45645: Microsoft Office Remote Code Execution Vulnerability

Synopsis

A heap-based buffer overflow in Microsoft Office allows an attacker to execute arbitrary code on a victim's machine. The vulnerability is triggered locally and requires no authentication, but the victim must open a specially crafted Office document, making this a social-engineering attack delivered through malicious files. Successful exploitation gives the attacker full code execution in the context of the victim's user account, enabling data theft, file modification, or further system compromise. A patched-image rebuild at version 16.0.5556.1001 (and equivalent channel releases) is available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host, or more commonly delivers a malicious document for the victim to open locally; no over-the-network service exposure is required.

• AuthenticationNot required

  No authentication or account credentials are required; the attacker exploits the vulnerability through a crafted document without any prior access to the target system.

• Victim interactionRequired

  The victim must open a specially crafted Office file, meaning the attack depends on a social-engineering step such as a phishing email or a malicious download.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or other environmental preconditions beyond the victim opening the file.

Blast Radius

• Executes arbitrary code in the context of the victim's user account, giving the attacker full control over anything that account can reach.
• Reads files accessible to the victim, including documents, credentials cached on disk, and browser-stored secrets.
• Writes or modifies files on the local filesystem, including dropping persistent malware or altering application data.
• Crashes or destabilizes the affected Office process, though full code execution makes denial of service the least likely attacker goal.