CVE-2026-45474: Microsoft Office Buffer Overflow Flaw

CVE-2026-45474 Overview

CVE-2026-45474 is a heap-based buffer overflow vulnerability in Microsoft Office that allows an unauthorized attacker to execute code locally. The flaw is tracked under [CWE-416] (Use After Free) and carries a CVSS 3.1 base score of 8.4. Microsoft published the advisory through the Microsoft Security Response Center (MSRC) update guide. Exploitation requires local access but no privileges and no user interaction, which expands the realistic attack surface to scenarios involving malicious documents processed by Office components.

Critical Impact
Successful exploitation grants an attacker full code execution in the context of the user, with high impact to confidentiality, integrity, and availability.

Affected Products

Microsoft Office (specific versions to be confirmed via the Microsoft Security Update Guide)

Discovery Timeline

2026-06-09 - CVE-2026-45474 published to the National Vulnerability Database (NVD)
2026-06-09 - Last updated in the NVD database

Technical Details for CVE-2026-45474

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow within Microsoft Office. Office processes structured document content during parsing and rendering, and an out-of-bounds write on the heap can corrupt adjacent allocations. The CWE classification of [CWE-416] indicates the underlying primitive involves a use-after-free condition that leads to heap corruption when an attacker controls the freed object's memory layout.

An attacker who controls heap layout can reuse the freed region to place attacker-controlled data. When Office later dereferences function pointers or virtual tables from the corrupted object, control flow transfers to attacker-chosen code. Because the vector is local and requires no user interaction or privileges, automated document processing pipelines and shared workstations are within scope.

Root Cause

The root cause is improper management of heap object lifetimes inside Office document handling code. A reference to a freed object remains reachable, and subsequent operations write past the bounds of a newly allocated structure occupying the same memory. Microsoft has not published source-level details. The full technical description is maintained in the Microsoft Security Update Guide.

Attack Vector

An attacker delivers a crafted Office document that, when opened or parsed locally, triggers the dangling pointer condition. No authentication is required and no user interaction is needed beyond standard document handling workflows. The result is arbitrary code execution under the privileges of the Office process.

No verified public proof-of-concept code is currently available. The vulnerability mechanism is described in prose; refer to the Microsoft advisory for additional technical references.

Detection Methods for CVE-2026-45474

Indicators of Compromise

Unexpected child processes spawned from winword.exe, excel.exe, powerpnt.exe, or outlook.exe, such as cmd.exe, powershell.exe, or rundll32.exe.
Office processes loading unsigned DLLs from user-writable directories including %TEMP%, %APPDATA%, or %LOCALAPPDATA%.
Crash events (Application Error, event ID 1000) referencing heap corruption in Office binaries.

Detection Strategies

Hunt for Office processes performing outbound network connections shortly after document open events.
Monitor for memory allocation anomalies and heap corruption signatures within Office process telemetry.
Inspect Office documents for embedded objects, ActiveX controls, and malformed structures that deviate from expected schemas.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block child process creation from Office applications and log the corresponding audit events.
Forward Sysmon process creation, image load, and file write events to a central SIEM for correlation with document open activity.
Track patch deployment state across endpoints to confirm Office builds match the fixed versions listed in the Microsoft advisory.

How to Mitigate CVE-2026-45474

Immediate Actions Required

Apply the Microsoft Office security update referenced in the Microsoft Security Update Guide on all affected endpoints.
Inventory Office installations and prioritize patching for users who routinely process documents from external sources.
Enable Protected View and Office macro restrictions to reduce the impact of malicious documents during the patch rollout.

Patch Information

Microsoft has issued a security update through standard Windows Update and Microsoft Update channels. Refer to the Microsoft Security Update Guide for the authoritative list of affected builds and corresponding fixed versions.

Workarounds

Enforce Protected View for documents originating from the Internet, untrusted locations, and Outlook attachments.
Block or disable legacy file format conversion where feasible, and restrict opening of Office documents from unmanaged shares.
Apply ASR rules to prevent Office applications from creating child processes and injecting code into other processes.

bash

# Configuration example: enable ASR rules via PowerShell
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions Enabled