CVE-2026-45475: Microsoft Office Buffer Overflow Flaw

CVE-2026-45475 Overview

CVE-2026-45475 is a heap-based buffer overflow vulnerability in Microsoft Office that allows an unauthorized attacker to execute code locally. The flaw is classified under [CWE-122] (Heap-based Buffer Overflow) and requires user interaction to trigger. An attacker can craft a malicious Office document that, when opened by a victim, corrupts heap memory and enables arbitrary code execution in the context of the current user.

Critical Impact
Successful exploitation grants attackers local code execution with the privileges of the user opening the document, providing a foothold for further compromise.

Affected Products

Microsoft Office (specific versions pending vendor disclosure)
Office desktop applications on Windows
Office components processing crafted document files

Discovery Timeline

2026-06-09 - CVE-2026-45475 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45475

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow within Microsoft Office document parsing routines. When Office processes a malformed file structure, it writes beyond the bounds of an allocated heap buffer. This out-of-bounds write corrupts adjacent heap metadata or object pointers, which an attacker can leverage to redirect execution flow.

The Common Weakness Enumeration classification is [CWE-122], indicating memory corruption on the heap rather than the stack. Heap overflows in Office applications typically lead to type confusion or controlled writes against function pointers used during document rendering. Exploitation results in code execution with the integrity level of the Office process.

Root Cause

The root cause is improper validation of input size or length fields within a structured Office document format. The parser allocates a heap buffer based on one value but writes attacker-controlled data of a larger size into it. The absence of bounds checking during the copy operation produces the overflow condition described in [CWE-122].

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a weaponized Office document through phishing email, malicious download, or shared file storage. When the victim opens the document, the vulnerable parser processes attacker-controlled data and triggers the heap overflow. No authentication is required on the target system.

The vulnerability impacts confidentiality, integrity, and availability. The Exploit Prediction Scoring System (EPSS) reports a low near-term exploitation probability as of 2026-06-11, and no public proof-of-concept code or in-the-wild exploitation has been confirmed. Refer to the Microsoft Security Update CVE-2026-45475 advisory for vendor-specific technical details.

Detection Methods for CVE-2026-45475

Indicators of Compromise

Unexpected child processes spawned by winword.exe, excel.exe, powerpnt.exe, or outlook.exe, such as cmd.exe, powershell.exe, or rundll32.exe
Office applications crashing with heap corruption exceptions in Windows Event Logs
Office processes loading unsigned DLLs or making outbound network connections shortly after document open
Creation of executable files or scripts in %TEMP% or %APPDATA% by Office processes

Detection Strategies

Monitor for anomalous process trees originating from Office applications, particularly script interpreters and LOLBins
Inspect inbound email attachments and shared files for malformed Office document structures
Enable Windows Defender Exploit Guard Attack Surface Reduction (ASR) rules that block Office child process creation
Correlate Office crash telemetry with subsequent suspicious file or network activity on the same host

Monitoring Recommendations

Collect endpoint telemetry covering process creation, image loads, and file writes from Office binaries
Forward Windows Application and Security event logs to a centralized analytics platform for correlation
Track Office application version inventory to identify unpatched endpoints across the environment
Alert on document files that trigger memory protection mitigations such as ASLR or DEP violations

How to Mitigate CVE-2026-45475

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-45475 advisory to all affected Office installations
Enable Protected View for documents originating from the internet, email attachments, and unsafe locations
Disable macros by default through Group Policy and require signed macros for trusted workflows
Block delivery of high-risk Office file formats at the email gateway pending patch deployment

Patch Information

Microsoft has published guidance and update packages through the Microsoft Security Response Center. Administrators should consult the Microsoft Security Update CVE-2026-45475 page for build numbers, KB identifiers, and deployment instructions across affected Office channels. Deploy patches via Microsoft Update, WSUS, Intune, or Configuration Manager.

Workarounds

Enforce Office ASR rules including "Block all Office applications from creating child processes" and "Block Win32 API calls from Office macros"
Configure File Block policies to prevent opening legacy or untrusted Office file formats
Use Microsoft Defender Application Guard for Office to isolate untrusted documents in a container
Provide targeted user awareness training on identifying suspicious attachments and document sources

bash

# Enable ASR rule: Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Enforce Protected View via registry for files from the internet
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f