CVE-2026-45645: Microsoft Office Buffer Overflow Flaw

CVE-2026-45645 Overview

CVE-2026-45645 is a heap-based buffer overflow in Microsoft Office that allows an unauthorized attacker to execute code locally. The flaw is categorized under [CWE-822] (Untrusted Pointer Dereference) and carries a CVSS 3.1 score of 7.8. Exploitation requires user interaction, typically opening a crafted Office document. Successful exploitation grants the attacker the privileges of the current user, enabling arbitrary code execution within the Office process context.

Critical Impact
An attacker who convinces a user to open a malicious Office file can execute arbitrary code on the target system with the user's privileges, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Microsoft Office (specific versions enumerated in the Microsoft Security Update Guide)
Refer to the Microsoft Security Update for the full list of affected builds
Endpoints running Microsoft Office on Windows are the primary attack surface

Discovery Timeline

2026-06-09 - CVE-2026-45645 published to the National Vulnerability Database (NVD)
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45645

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow within Microsoft Office's document parsing logic. When Office processes a malformed document, an untrusted pointer is dereferenced and used to write beyond the bounds of a heap-allocated buffer. The condition aligns with [CWE-822], in which the application trusts a pointer value derived from attacker-controlled input. Memory corruption on the heap allows an attacker to overwrite adjacent objects, including function pointers or vtable entries, redirecting execution flow.

The attack vector is local. The attacker must deliver a crafted file via email, web download, or removable media. User interaction is required because the target must open the document in Microsoft Office. Once execution flow is hijacked, the attacker runs code in the security context of the logged-on user, enabling persistence, credential theft, or lateral movement.

Root Cause

The root cause is improper validation of pointer or offset values during deserialization of structured Office document content. The parser uses attacker-controlled metadata to compute a destination address or length, producing an out-of-bounds heap write. Without sufficient bounds and pointer integrity checks, the corrupted heap state enables controlled code execution.

Attack Vector

An attacker crafts a malicious Office document containing manipulated structures that trigger the heap overflow. Delivery typically occurs through phishing emails containing the document as an attachment or a link to a hosted file. When the victim opens the file, the parsing routine corrupts heap memory, and the attacker gains code execution with the user's privileges. The Microsoft Security Update Guide entry for this CVE describes affected builds and patch availability.

Detection Methods for CVE-2026-45645

Indicators of Compromise

Microsoft Office processes (winword.exe, excel.exe, powerpnt.exe) spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe
Office applications writing executable payloads to user-writable directories (%APPDATA%, %TEMP%, %LOCALAPPDATA%)
Crash events or Watson reports referencing heap corruption in Office binaries
Outbound network connections initiated by Office processes to unfamiliar domains or IP addresses

Detection Strategies

Monitor process lineage for Office applications launching scripting interpreters, LOLBins, or unsigned executables
Inspect inbound email gateways for Office documents containing anomalous embedded structures or macros
Correlate Office crash telemetry with subsequent suspicious child-process or network activity
Hunt for files matching known malicious document hashes referenced by threat intelligence feeds

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office from creating child processes and from injecting code into other processes
Ingest Windows Sysmon Event IDs 1 (process creation), 11 (file create), and 3 (network connect) into your SIEM for Office processes
Track Office application telemetry for repeated crashes that may indicate exploitation attempts
Alert on Office processes loading unsigned DLLs or accessing the LSASS process

How to Mitigate CVE-2026-45645

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Office installations
Prioritize patching endpoints used by high-risk users such as executives, finance, and IT administrators
Block inbound email attachments with risky Office file extensions at the mail gateway pending patch deployment
Verify endpoint protection telemetry is reporting from all Office hosts

Patch Information

Microsoft has published a security update for CVE-2026-45645. Administrators should review the Microsoft Security Update Guide for the affected product versions and corresponding update KBs, then deploy through Windows Update, Microsoft Update, WSUS, or Microsoft Configuration Manager.

Workarounds

Enable Protected View for documents originating from the internet and email attachments
Configure Office to block macros from running in files from the internet using Group Policy
Apply Microsoft Defender ASR rules to prevent Office applications from creating child processes
Restrict Office file opening via Windows Defender Application Control or AppLocker policies for unmanaged document sources

bash

# Group Policy registry settings to harden Microsoft Office against malicious documents
# Block macros in files from the internet (Word example)
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security" /v blockcontentexecutionfrominternet /t REG_DWORD /d 1 /f

# Enforce Protected View for files originating from the internet
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f

# Enable ASR rule: Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled