CVE-2026-45471: Microsoft Office Word RCE Vulnerability

CVE-2026-45471 Overview

CVE-2026-45471 is a local code execution vulnerability in Microsoft Office Word. The flaw stems from an untrusted pointer dereference [CWE-822] in the application's document handling logic. An attacker who convinces a user to open a crafted document can execute arbitrary code in the context of the current user. Microsoft documents the issue in its Security Update Guide.

The vulnerability requires user interaction and local attack vector access, typically delivered through phishing or malicious file distribution. No public proof-of-concept exploit is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Successful exploitation enables arbitrary code execution with the privileges of the targeted user, providing initial access for subsequent compromise of the host.

Affected Products

Microsoft Office Word (refer to Microsoft Security Update Guide for affected build numbers)

Discovery Timeline

2026-06-09 - CVE-2026-45471 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45471

Vulnerability Analysis

The vulnerability is classified under [CWE-822] Untrusted Pointer Dereference. Microsoft Word reads pointer values from attacker-controlled data inside a document and dereferences them without sufficient validation. The application then operates on memory at an address the attacker influences, which corrupts program state or redirects execution flow.

Exploitation requires the victim to open a malicious .docx, .rtf, or related Office document. Because the attack vector is local with user interaction required, threat actors typically pair this class of bug with social engineering, spear-phishing attachments, or drive-by document downloads. Confidentiality, integrity, and availability are all impacted on the target host.

The EPSS probability is 0.079% as of 2026-06-11, indicating limited observed exploitation activity at publication. Office document parsing flaws of this category have historically been weaponized by both commodity malware operators and targeted intrusion sets, so defenders should not rely on the low score to defer patching.

Root Cause

The root cause is improper validation of a pointer value sourced from untrusted document content. When Word parses the affected structure, it treats the value as a valid memory reference and performs a read or write operation through it. Attackers craft document fields so the dereferenced pointer lands on attacker-controlled data, enabling control over execution.

Attack Vector

The attack begins with delivery of a weaponized Office document through email, web download, or removable media. When the user opens the file in a vulnerable version of Word, parsing logic dereferences the malicious pointer and triggers code execution. No elevated privileges are required prior to exploitation. See the Microsoft Security Update Guide entry for vendor technical detail.

// No verified public proof-of-concept code is available.
// The vulnerability is triggered by a crafted Office document
// that supplies an attacker-controlled pointer value parsed by Word.

Detection Methods for CVE-2026-45471

Indicators of Compromise

Unexpected child processes spawned by WINWORD.EXE such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Office documents arriving from external senders containing embedded objects, unusual OLE streams, or macros that reference shellcode-like blobs.
Crash events or Windows Error Reporting entries citing access violations within winword.exe or related Office modules.

Detection Strategies

Hunt for process lineage where WINWORD.EXE is the parent of script interpreters or LOLBins, then pivot to network connections and file writes from those children.
Inspect inbound email gateways for documents with anomalous structure, oversized embedded objects, or known malicious template injection patterns.
Correlate document open events with subsequent persistence operations such as scheduled task creation, registry Run key writes, or DLL drops in user-writable paths.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block child process creation and Win32 API calls from Office applications.
Forward Sysmon Event IDs 1, 7, and 11 along with Office telemetry into a centralized analytics platform for behavior-based hunting.
Track failed and successful exploitation crash signatures within Windows Error Reporting and EDR telemetry to surface targeted attempts.

How to Mitigate CVE-2026-45471

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory across all systems running Microsoft Office Word.
Prioritize patching of high-risk user populations such as executives, finance, legal, and HR who routinely process external documents.
Restrict execution of macros and active content from documents originating outside the organization until patching is complete.

Patch Information

Microsoft has released security updates through the standard Patch Tuesday channel. Administrators should consult the Microsoft Security Update Guide to identify the specific KB articles and build numbers that address CVE-2026-45471 for each supported Office channel, including Microsoft 365 Apps, Office LTSC, and Office 2019/2021.

Workarounds

Enforce Protected View and Office Application Guard for documents from the internet and email attachments to contain exploitation attempts.
Block or quarantine inbound Office document file types at the email gateway when business workflows allow.
Configure Group Policy to disable legacy file format handlers that are not required, reducing the parsing attack surface.

bash

# Group Policy registry example: enforce Protected View for files originating from the internet
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachementsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f