CVE-2026-45472 Overview
CVE-2026-45472 is a heap-based buffer overflow vulnerability in Microsoft Office that allows an unauthorized attacker to execute code locally. The flaw is categorized under [CWE-416] (Use After Free) and affects the heap memory management routines used when Office processes specially crafted documents. Successful exploitation results in arbitrary code execution in the context of the current user, with high impact to confidentiality, integrity, and availability.
Critical Impact
An attacker who successfully exploits this vulnerability can run arbitrary code on the target system, gaining the privileges of the user opening the malicious Office document.
Affected Products
- Microsoft Office (specific versions listed in the Microsoft Security Response Center advisory)
Discovery Timeline
- 2026-06-09 - CVE-2026-45472 published to the National Vulnerability Database
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-45472
Vulnerability Analysis
The vulnerability is a heap-based buffer overflow in Microsoft Office triggered when the application parses crafted document content. The CWE classification of [CWE-416] indicates the underlying defect involves accessing memory after it has been freed, leading to corruption of heap structures. When an attacker controls the contents written into the freed region, the corrupted heap state can be leveraged to redirect execution flow.
The attack vector is local, meaning the attacker must convince a user to open a malicious file on the target machine. No prior authentication or user interaction beyond opening the file is required by the system. Exploitation yields code execution with the privileges of the targeted user account.
Root Cause
The root cause is improper memory management in Office's document parsing logic. A heap object is freed while a reference to it remains live, and subsequent use of that dangling pointer corrupts the heap. Attackers can shape the heap to place attacker-controlled data where the freed object resided, gaining control over object virtual function tables or other indirect call targets.
Attack Vector
Exploitation requires delivering a malicious Office document to the victim through email, file share, removable media, or web download. When the victim opens the document, Office processes the crafted structures and triggers the use-after-free condition. The vulnerability does not require authentication, and the CVSS vector indicates no user interaction beyond file handling is mandated by the metric.
No public proof-of-concept code is available for CVE-2026-45472 at the time of publication. Technical specifics are described in the Microsoft CVE-2026-45472 Vulnerability Update.
Detection Methods for CVE-2026-45472
Indicators of Compromise
- Unexpected child processes spawned by winword.exe, excel.exe, or powerpnt.exe, particularly cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
- Office applications writing executable files or scripts to %TEMP%, %APPDATA%, or user profile directories.
- Office processes crashing repeatedly when opening specific documents, indicating failed exploitation attempts.
- Outbound network connections initiated directly by Office processes to untrusted destinations.
Detection Strategies
- Monitor process creation events with parent images matching Microsoft Office binaries and unusual child processes.
- Hunt for anomalous memory allocation patterns and heap corruption telemetry within Office processes.
- Inspect inbound Office documents at the mail gateway for embedded objects, macros, and structurally malformed streams.
Monitoring Recommendations
- Enable and forward Microsoft Defender Attack Surface Reduction (ASR) rule events that block Office child processes.
- Centralize Sysmon process, image load, and file creation events from endpoints into a SIEM for correlation.
- Track Office crash reports through Windows Error Reporting to identify potential exploitation attempts.
How to Mitigate CVE-2026-45472
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-45472 as soon as it is available in your patch cycle.
- Enforce Protected View and block macros from documents originating from the internet via Group Policy.
- Restrict execution of child processes by Office applications using Microsoft Defender ASR rules.
- Restrict delivery of high-risk file types at the email gateway and apply sandbox detonation to inbound attachments.
Patch Information
Microsoft has published guidance and updates for CVE-2026-45472 through the Microsoft Security Response Center. Refer to the Microsoft CVE-2026-45472 Vulnerability Update for the affected build numbers, KB articles, and channel-specific update packages.
Workarounds
- Disable opening of files from untrusted sources and enforce Protected View for documents from the internet and Outlook attachments.
- Configure Trust Center settings to block ActiveX controls and disable embedded OLE object activation where business requirements allow.
- Deploy application allowlisting to prevent unauthorized child processes from Office binaries until patches are applied.
# Enable Microsoft Defender ASR rule to block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
# Block Office from creating executable content
Set-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 -AttackSurfaceReductionRules_Actions Enabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
