CVE-2026-45649: Office for Android Spoofing Vulnerability

Synopsis

An improper access control vulnerability in Microsoft Office for Android (Excel, PowerPoint, and Word) allows a local attacker to perform spoofing attacks. The exploit requires no authentication but does require the victim to take some action; it is reached locally on the device rather than over a network. Successful exploitation allows the attacker to read sensitive data and tamper with content through spoofing, though availability is not affected. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the device is required to trigger this vulnerability.

• AuthenticationNot required

  No account or credentials are required; the attacker can trigger the vulnerability without authenticating to any service or application.

• Victim interactionRequired

  The victim must perform some action, such as opening a crafted file or following a malicious link, for the exploit to succeed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race conditions, or memory-layout knowledge.

Blast Radius

• The attacker can read high-confidence sensitive data accessible to the Office application, including locally stored documents, cached credentials, or session tokens.
• The attacker can modify or forge content within the application, such as altering displayed document metadata or spoofing the apparent source of a file.
• Availability of the affected application and its data is not impacted by this vulnerability.
• Scope is limited to the affected application on the local device; there is no indication of lateral movement to other system components.