CVE-2026-45649 Overview
CVE-2026-45649 is an improper access control vulnerability in Microsoft Office for Android. The flaw allows an unauthorized local attacker to perform spoofing against the targeted application. Microsoft published the advisory on June 9, 2026, and the issue is tracked under CWE-284: Improper Access Control.
Exploitation requires local access and user interaction, but no privileges are needed on the device. A successful attack can affect the confidentiality and integrity of data handled by Office for Android. The vulnerability does not impact availability and is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Critical Impact
An unauthorized attacker with local access can spoof trusted content within Office for Android, leading to high-confidentiality and high-integrity impact through user interaction.
Affected Products
- Microsoft Office for Android
- Mobile productivity components shipped with Office for Android
- Refer to the Microsoft CVE-2026-45649 Advisory for the authoritative list of affected builds
Discovery Timeline
- 2026-06-09 - CVE CVE-2026-45649 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-45649
Vulnerability Analysis
CVE-2026-45649 stems from improper access control inside Office for Android. The application fails to enforce sufficient restrictions on resources or interfaces that should be limited to trusted callers. An attacker installed on the same device, or able to deliver content the user opens, can leverage this gap to spoof legitimate Office UI elements or data.
The attack vector is local, meaning the adversary must already have code execution or app presence on the Android device. User interaction is required, which typically involves the victim opening a crafted document, link, or intent. Because confidentiality and integrity are both rated high, an attacker can read sensitive content rendered in Office and alter what the user perceives as authentic.
Spoofing in this context can support follow-on phishing, credential capture, or document tampering. The vulnerability does not directly produce code execution or denial of service, but it weakens trust boundaries that other attacks rely on.
Root Cause
The root cause is classified as CWE-284: Improper Access Control. Office for Android does not adequately validate the source or permissions of a request before acting on it. This allows another local app, or attacker-controlled content, to invoke functionality or render information as if it originated from a trusted component.
Attack Vector
An attacker plants a malicious application or content on the Android device. When the user opens Office for Android and interacts with the crafted artifact, the application processes it without verifying the caller's authorization. The result is spoofed content that the user treats as legitimate Office output.
No verified proof-of-concept code is available for CVE-2026-45649. Technical specifics are not disclosed in the public advisory beyond the vulnerability class and impact metrics. Refer to the Microsoft CVE-2026-45649 Advisory for vendor-supplied details.
Detection Methods for CVE-2026-45649
Indicators of Compromise
- Unexpected Office for Android documents or prompts appearing after installing or updating third-party Android applications.
- Android intents directed at Microsoft Office package components originating from untrusted or sideloaded apps.
- User reports of Office dialogs, share sheets, or document previews that display unexpected branding or content.
Detection Strategies
- Inventory Office for Android versions across managed mobile devices and compare against the fixed builds listed in the Microsoft advisory.
- Use mobile threat defense or MDM logs to identify apps that send intents to Office for Android components.
- Hunt for newly installed Android applications that request permissions to interact with Office documents or storage.
Monitoring Recommendations
- Enable mobile application telemetry collection through your EMM or UEM platform and forward events to a central analytics platform.
- Track Office for Android crash and error telemetry through Microsoft Intune or equivalent management tooling.
- Alert on user-reported spoofing or phishing indicators referencing Office content on Android endpoints.
How to Mitigate CVE-2026-45649
Immediate Actions Required
- Update Office for Android to the fixed version published in the Microsoft CVE-2026-45649 Advisory through the Google Play Store or managed app distribution.
- Enforce automatic updates for Microsoft Office on managed Android devices using your MDM or UEM policy.
- Restrict sideloading of applications on corporate Android devices to reduce the local attack surface.
- Educate users to verify the source of documents and intents before interacting with Office for Android prompts.
Patch Information
Microsoft has issued a fix for CVE-2026-45649. Administrators should consult the Microsoft CVE-2026-45649 Advisory for the patched build numbers and deploy them through Google Play managed distribution or Microsoft Intune app protection policies.
Workarounds
- Block installation of untrusted third-party applications on devices that handle sensitive Office content.
- Apply Android work profile separation so Office for Android only processes content from managed sources.
- Disable opening of unsolicited documents and links from messaging or sideloaded applications until the patch is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
