CVE-2026-45460: Microsoft Office Information Disclosure

CVE-2026-45460 Overview

CVE-2026-45460 is an out-of-bounds read vulnerability in Microsoft Office that allows an unauthorized attacker to disclose information locally. The flaw is categorized under [CWE-126] (Buffer Over-read) and carries a CVSS 3.1 base score of 4.7. Successful exploitation requires user interaction, such as opening a malicious document, and grants the attacker access to memory contents outside the bounds of an allocated buffer. The vulnerability impacts confidentiality only, with no direct effect on integrity or availability. Microsoft has acknowledged the issue and published guidance through the Microsoft Security Response Center.

Critical Impact
Exploitation can leak sensitive in-process memory from Microsoft Office, including data that may aid in bypassing exploit mitigations or staging further attacks.

Affected Products

Microsoft Office (versions identified by Microsoft in the official advisory)
Office components that parse untrusted document content
See the Microsoft Security Update Guide for the full affected build list

Discovery Timeline

2026-06-09 - CVE-2026-45460 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45460

Vulnerability Analysis

The vulnerability is an out-of-bounds read in Microsoft Office document parsing logic. When Office processes a crafted file, an arithmetic or bounds-checking error allows the parser to read beyond the end of an allocated buffer. The leaked bytes can include heap metadata, pointers, or fragments of other documents currently loaded in the process. An attacker who lures a user into opening a malicious file can capture this disclosed memory through embedded objects, scripted document logic, or telemetry channels controlled by the document.

The attack complexity is rated High because successful disclosure depends on heap layout and the specific document content the victim has open. The scope is unchanged, and only confidentiality is affected. The Exploit Prediction Scoring System (EPSS) rates the probability of exploitation at 0.053%.

Root Cause

The root cause is a buffer over-read, classified as [CWE-126]. Office reads past the declared length of a structured field within a document, either because a size value is trusted without validation or because index calculations omit a boundary check. The parser then returns the over-read bytes to a code path that exposes them to attacker-controlled logic inside the document.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted Office document through email, file share, or web download. When the victim opens the file in a vulnerable Office build, the parser triggers the out-of-bounds read. No elevated privileges are required by the attacker, and authentication is not needed. Verified proof-of-concept code is not publicly available at this time.

No verified exploit code is published for CVE-2026-45460. Refer to the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2026-45460

Indicators of Compromise

Office documents containing malformed structured storage streams or unexpected field-length values
Office processes spawning child processes or initiating outbound network connections shortly after a document is opened
Unusual file reads from %TEMP% or user profile directories by winword.exe, excel.exe, or powerpnt.exe

Detection Strategies

Inspect inbound Office documents at the mail gateway and web proxy for malformed binary structures and anomalous embedded objects
Apply EDR rules that flag Office applications reading or transmitting memory regions to attacker-controlled channels such as embedded ActiveX, OLE, or remote templates
Correlate document open events with subsequent outbound DNS or HTTP traffic from Office processes

Monitoring Recommendations

Enable Microsoft Office telemetry and audit logs for document open events and macro execution
Forward endpoint process and file telemetry to a centralized analytics platform for retroactive hunting once vendor IOCs are released
Monitor for crash dumps and Watson reports from Office processes, which can indicate failed exploitation attempts

How to Mitigate CVE-2026-45460

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as it is available for your Office channel
Block or quarantine Office documents from untrusted senders at the email gateway until patches are deployed
Enforce Protected View and Application Guard for documents originating from the internet

Patch Information

Microsoft has published an advisory for CVE-2026-45460 through the Microsoft Security Response Center. Administrators should consult the Microsoft Security Update Guide to identify the specific update package for each affected Office channel and deploy it through Microsoft Update, WSUS, Intune, or Configuration Manager.

Workarounds

Disable opening of documents from the internet by enforcing Protected View through Group Policy
Restrict Office macro execution and block legacy file formats such as .doc, .xls, and .ppt from untrusted sources
Train users to validate the source of unexpected Office attachments before opening them

bash

# Enforce Protected View for files originating from the internet (Group Policy registry keys)
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f