CVE-2026-45456: Microsoft Office RCE Vulnerability

CVE-2026-45456 Overview

CVE-2026-45456 is a type confusion vulnerability (CWE-843) in Microsoft Office. An unauthorized attacker can execute arbitrary code locally by accessing a resource using an incompatible type. The flaw does not require authentication or user interaction once a malicious file is processed by the application. Successful exploitation grants the attacker the privileges of the current user, enabling installation of programs, data theft, or creation of new accounts with elevated rights.

Critical Impact
Local code execution in Microsoft Office with no privileges required and no user interaction, impacting confidentiality, integrity, and availability.

Affected Products

Microsoft Office (specific versions to be confirmed via the Microsoft Security Update Guide)
Refer to the Microsoft Security Update CVE-2026-45456 advisory for the authoritative product and build list

Discovery Timeline

2026-06-09 - CVE-2026-45456 published to the National Vulnerability Database (NVD)
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45456

Vulnerability Analysis

The vulnerability is classified as type confusion, where Microsoft Office accesses a resource using a type that is incompatible with its actual representation in memory. When the application interprets an object of one type as another, the resulting field offsets, virtual function tables, or pointer values become attacker-controlled. This mismatch allows an adversary to redirect execution flow during routine document parsing or object handling.

Local exploitation produces a high impact across confidentiality, integrity, and availability. Code executes in the context of the user running Office, which on many endpoints includes access to sensitive documents, cached credentials, and persistence locations. The EPSS probability stands at 0.15% as of 2026-06-11, indicating limited observed exploitation activity at disclosure.

Root Cause

The root cause is improper type validation when Office dereferences or casts an object during file parsing. Microsoft has not published implementation specifics, but type confusion in Office historically involves crafted OLE objects, embedded controls, or document streams that misrepresent their structure. The parser proceeds without verifying that the underlying memory matches the expected type.

Attack Vector

An attacker delivers a crafted Office document to the target system. When the file is opened or processed locally, the type confusion triggers during parsing, leading to arbitrary code execution in the user's context. The attack vector is local, and no privileges or user interaction beyond standard file handling are required by the CVSS metrics.

No public proof-of-concept code is available at the time of publication. Technical specifics are documented in the Microsoft Security Update CVE-2026-45456 advisory.

Detection Methods for CVE-2026-45456

Indicators of Compromise

Unexpected child processes spawned by winword.exe, excel.exe, powerpnt.exe, or outlook.exe, such as cmd.exe, powershell.exe, or rundll32.exe
Office applications writing executable content to %TEMP%, %APPDATA%, or user profile directories
Crashes or anomalous exception events in Office processes correlated with document opens

Detection Strategies

Hunt for process lineage where Office binaries launch script interpreters or LOLBins, mapped to MITRE ATT&CK technique T1203 (Exploitation for Client Execution)
Inspect inbound email attachments and shared documents for malformed OLE streams or embedded objects with inconsistent type identifiers
Correlate Office process crashes with subsequent network connections or persistence creation events

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and executable content
Forward Office telemetry, Sysmon process and file events, and EDR alerts to a centralized data lake for behavioral correlation
Alert on writes to autorun locations and scheduled task creation following document open events

How to Mitigate CVE-2026-45456

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-45456 advisory across all Office installations
Prioritize patching on systems that routinely process documents from external sources, including knowledge workers and email gateways
Audit endpoints for unpatched Office builds and enforce remediation through standard patch management workflows

Patch Information

Microsoft has released a security update addressing CVE-2026-45456. Administrators should consult the Microsoft Security Update Guide for the affected version list, KB article numbers, and deployment guidance. Updates are distributed through Microsoft Update, WSUS, Microsoft Intune, and Microsoft 365 Apps update channels.

Workarounds

Enable Protected View and Office Application Guard to isolate documents originating from the internet or other untrusted locations
Configure ASR rules to block Office child process creation and executable content generation
Restrict macro execution and block legacy file formats at the email gateway until patching is complete

bash

# Enable Microsoft Defender ASR rules via PowerShell
Set-MpPreference -AttackSurfaceReductionRules_Ids `
    D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
    -AttackSurfaceReductionRules_Actions Enabled

Set-MpPreference -AttackSurfaceReductionRules_Ids `
    3B576869-A4EC-4529-8536-B80A7769E899 `
    -AttackSurfaceReductionRules_Actions Enabled