CVE-2026-45458: Microsoft 365 Apps RCE Vulnerability

CVE-2026-45458 Overview

CVE-2026-45458 is a type confusion vulnerability in Microsoft Office that allows an unauthorized attacker to execute code locally. The flaw stems from accessing a resource using an incompatible type, which corrupts program state during document parsing. An attacker who convinces a user to open a crafted Office document can run arbitrary code in the context of the current user. The vulnerability affects multiple Office releases, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, SharePoint Server, and Word 2016. Microsoft published the advisory in its security update guide and released patches through the standard update channel.

Critical Impact
Successful exploitation grants attackers arbitrary code execution with the privileges of the user running Microsoft Office, enabling document-borne payload delivery, lateral movement, and data theft.

Affected Products

Microsoft 365 Apps (x86 and x64 Enterprise), Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, Office 2024 LTSC (Windows and macOS)
Microsoft SharePoint Server Subscription Edition, 2019, and 2016 Enterprise; Microsoft Word 2016

Discovery Timeline

2026-06-09 - CVE-2026-45458 published to the National Vulnerability Database
2026-06-11 - Last updated in NVD database

Technical Details for CVE-2026-45458

Vulnerability Analysis

The vulnerability is a type confusion condition in Microsoft Office's document handling logic. The application accesses a memory resource assuming one data type while the underlying object holds a different, incompatible type. This mismatch lets an attacker manipulate object layout and gain control over execution flow. The CWE-416 reference indicates memory-lifetime confusion between object instances during parsing of malicious content.

Because the attack vector is local and requires no privileges or user interaction beyond opening the file, weaponized documents delivered through email, file shares, or SharePoint can trigger the flaw. The shared nature of SharePoint Server expands the blast radius beyond individual workstations.

Root Cause

The root cause is improper validation of object types when Office parses structured document content. When the parser dereferences a pointer or invokes a virtual method on an object whose type does not match the expected type, the resulting memory access corrupts critical structures. Attackers craft documents that force the parser into this confused state and supply controlled data interpreted as a function pointer or vtable.

Attack Vector

An attacker delivers a malicious Office document (.docx, .doc, .rtf, or related formats) to a target. Opening the document in a vulnerable Office build triggers the type confusion and executes attacker-supplied shellcode in the user context. The Preview Pane is a common implicit trigger for Office parsing flaws and should be considered an attack surface. No code sample is published for this issue; refer to the Microsoft Security Update CVE-2026-45458 advisory for vendor technical detail.

Detection Methods for CVE-2026-45458

Indicators of Compromise

Unexpected child processes spawned by WINWORD.EXE, EXCEL.EXE, or POWERPNT.EXE, particularly cmd.exe, powershell.exe, rundll32.exe, or mshta.exe
Office processes writing executable content to %AppData%, %Temp%, or %ProgramData%
Outbound network connections initiated directly by Office binaries to uncategorized or recently registered domains
Crash dumps or Windows Error Reporting events referencing access violations inside Office DLLs after opening a document

Detection Strategies

Hunt for process-lineage anomalies where Office applications spawn scripting interpreters or LOLBins
Inspect documents arriving from external senders for embedded objects, malformed structures, or unusual macros
Correlate Office crash telemetry with file-open events to surface failed exploitation attempts

Monitoring Recommendations

Forward Sysmon Event ID 1 (process creation) and Event ID 11 (file create) from endpoints running Office to a centralized analytics platform
Monitor SharePoint Server logs for anomalous document uploads, view counts, and unusual file types
Enable and review Microsoft Defender Attack Surface Reduction (ASR) audit events targeting Office child-process and code-injection rules

How to Mitigate CVE-2026-45458

Immediate Actions Required

Apply the Microsoft security updates for all affected Office and SharePoint versions referenced in the vendor advisory
Prioritize patching of SharePoint Servers and shared workstations where users routinely open external documents
Enable Microsoft Defender ASR rules that block Office applications from creating child processes and injecting into other processes
Configure Protected View and Block Macros from the Internet via Group Policy for all Office clients

Patch Information

Microsoft released fixes through its standard monthly update cycle. Administrators should consult the Microsoft Security Update CVE-2026-45458 advisory for the specific build numbers required for Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, SharePoint Server, and Word 2016. Click-to-Run installations receive updates automatically when the update channel is current; MSI-based installs require deployment through Windows Update, WSUS, or Microsoft Update Catalog.

Workarounds

Disable the Outlook Preview Pane and Windows Explorer preview handlers for Office file types until patches are deployed
Open untrusted documents only in Protected View or Office for the Web, which sandboxes parsing away from the user session
Restrict inbound document delivery using mail-gateway content inspection and block legacy binary formats where business operations allow

bash

# Group Policy registry settings to harden Office document handling
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security" /v BlockContentExecutionFromInternet /t REG_DWORD /d 1 /f