CVE-2026-47635: Microsoft Outlook and Word Remote Code Execution Vulnerability

Synopsis

A type confusion vulnerability in Microsoft Office (Outlook and Word) allows an attacker with access to the host to execute arbitrary code without any authentication or user interaction. The flaw is reachable locally, meaning the attacker needs an existing foothold on the affected system, and successful exploitation grants full code execution with the privileges of the running application. A patched-image rebuild at the fixed version is available on HarborGuard for environments running an affected version of Microsoft Office LTSC 2024.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing exposure is required to trigger the vulnerability.

• AuthenticationNot required

  No account or credentials are required; the vulnerability is reachable by any process or user with local access to the affected system.

• Victim interactionNot required

  Exploitation does not require any action from another user on the system; the attacker can trigger the type confusion directly.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• Reads sensitive files and data accessible to the Office process, including stored credentials, documents, and application data.
• Modifies or overwrites files and application state accessible under the current user or process context.
• Crashes or destabilizes the affected Office application and any dependent processes.
• Executes attacker-supplied code at the privilege level of the compromised Office process, enabling further lateral movement on the host.