CVE-2026-47635: Microsoft Office RCE Vulnerability

CVE-2026-47635 Overview

CVE-2026-47635 is a type confusion vulnerability in Microsoft Office that allows an unauthorized attacker to execute code locally. The flaw stems from access of a resource using an incompatible type, classified under [CWE-122] (Heap-based Buffer Overflow). An attacker who successfully exploits the issue can run arbitrary code in the context of the user opening a crafted Office document. The vulnerability requires no privileges and no user interaction beyond local execution conditions, and it affects confidentiality, integrity, and availability at the highest impact level.

Critical Impact
A successful exploit grants the attacker code execution on the target system with the privileges of the affected Office process, enabling document-borne intrusion paths.

Affected Products

Microsoft Office (specific versions listed in the Microsoft Security Update Guide)

Discovery Timeline

2026-06-09 - CVE-2026-47635 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-47635

Vulnerability Analysis

The vulnerability is a Type Confusion condition in Microsoft Office. Type confusion occurs when code allocates or accesses a resource using one type but later operates on it as if it were a different, incompatible type. In practice, this allows an attacker to control fields, pointers, or virtual function tables that would otherwise be protected by type-safety guarantees.

The National Vulnerability Database maps this issue to [CWE-122], indicating that the type confusion leads to heap memory corruption. When Office parses a crafted document, the mismatched type interpretation produces an out-of-bounds heap write or controlled pointer dereference. This corruption is the foundation for code execution.

The attack vector is local. The attacker must convince a user to open a malicious file on the system, but no elevated privileges and no additional interaction are required once the file is opened. The scope is unchanged, with high impact across confidentiality, integrity, and availability.

Root Cause

The root cause is a missing or incorrect type check during deserialization or object handling inside Microsoft Office. The application treats an attacker-controlled object as a different type, allowing memory layout assumptions to be violated and adjacent heap structures to be manipulated.

Attack Vector

An attacker crafts a malicious Office document (such as Word, Excel, or PowerPoint content) containing embedded objects designed to trigger the type confusion. The document is delivered through phishing, file shares, or other delivery channels. When the user opens the document, the Office parser instantiates the malicious object, the type mismatch is triggered, and the resulting heap corruption is leveraged to redirect execution into attacker-controlled code.

No verified proof-of-concept code has been published. See the Microsoft Security Update Guide for vendor-published technical details.

Detection Methods for CVE-2026-47635

Indicators of Compromise

Unexpected crashes or exception logs in WINWORD.EXE, EXCEL.EXE, or POWERPNT.EXE correlated with the opening of external documents.
Office processes spawning unusual child processes such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Office processes writing executable files or scripts to user-writable directories such as %TEMP% or %APPDATA%.

Detection Strategies

Hunt for parent-child process relationships where Office applications launch script interpreters or LOLBins shortly after document open events.
Monitor for Office processes making outbound network connections to untrusted hosts immediately after document load.
Inspect telemetry for heap corruption signals such as access violations in Office binaries followed by anomalous module loads.

Monitoring Recommendations

Enable detailed Office telemetry and Windows Defender Application Guard logging where supported.
Forward endpoint process creation events (Sysmon Event ID 1) and image load events (Event ID 7) to a central SIEM for correlation.
Track document provenance using Mark-of-the-Web (MOTW) attributes to flag files opened from external sources.

How to Mitigate CVE-2026-47635

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Update Guide to all affected Office installations.
Inventory endpoints running Microsoft Office and prioritize patching for users who routinely process documents from external sources.
Enforce Protected View and Block Macros from the Internet through Group Policy until patching is complete.

Patch Information

Microsoft has published patch details and affected build numbers in the Microsoft Security Update Guide entry for CVE-2026-47635. Administrators should consult the advisory to identify the specific Office channel (Current Channel, Monthly Enterprise Channel, Semi-Annual Channel, Office LTSC) and apply the corresponding update.

Workarounds

Configure Attack Surface Reduction (ASR) rules to block Office applications from creating child processes and from injecting code into other processes.
Deliver Office documents through sandboxed viewers or Application Guard for Office where the deployment supports it.
Restrict opening of documents originating from the internet by enforcing Mark-of-the-Web and Protected View policies.

bash

# Example: enable ASR rule to block Office from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled