What is the CVSS score of CVE-2026-44819?

CVE-2026-44819 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Office are affected by CVE-2026-44819?

Microsoft Office contains a local code execution vulnerability (CVE-2026-44819, CVSS 7.8) allowing arbitrary code execution when users open maliciously crafted documents, potentially enabling data…. A patch is available.

How to fix or mitigate CVE-2026-44819?

24 hours: Alert all users to avoid opening documents from untrusted sources; conduct audit of Office versions and deployment; ensure email gateways filter or sandbox Office document attachments. 7 days: Deploy endpoint detection and response (EDR) solutions to monitor for exploitation attempts in Office processes (winword.exe, excel.exe, powerpnt.exe); document legacy systems unable to receive patches; test incident response and backup recovery procedures. 30 days: Apply Microsoft security update to all Office installations immediately upon release by Microsoft Security Response Center; validate complete patch deployment across the organization; review security logs for exploitation indicators.

Microsoft Office CVE-2026-44819

EUVD-2026-35662 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-09 secure@microsoft.com

GHSA-3rh7-cg3h-rr3p

Heap Overflow Microsoft Buffer Overflow 365 Apps Microsoft 365 Office 2016 Office 2019 Office 2021 Office 2024 Sharepoint Server

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 18:30 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Office is possible when a user opens a maliciously crafted document that triggers a heap-based buffer overflow (CWE-122), allowing the attacker to run arbitrary code in the context of the opened Office process. The CVSS 7.8 (AV:L/AC:L/PR:N/UI:R) reflects a user-interaction-driven local exploit rather than a remote network attack, and no public exploit identified at time of analysis. The flaw was reported through Microsoft Security Response Center (secure@microsoft.com) and is tracked in MSRC's update guide.

Technical ContextAI

The vulnerability is a heap-based buffer overflow (CWE-122), a memory-corruption class in which a parser writes beyond the bounds of a heap-allocated buffer - typically during processing of a structured file format (DOC/DOCX/XLS/XLSX/PPT/PPTX, RTF, or embedded objects/images). Microsoft Office is a desktop productivity suite whose document parsers historically have been a recurring source of heap-corruption bugs reachable via crafted files. Successful overflow can corrupt adjacent heap metadata or object pointers, which an attacker leverages to hijack control flow inside the Office process. No CPE strings were provided in the input, so the exact Office channel/version range must be derived from the MSRC advisory rather than NVD CPE data.

RemediationAI

Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44819 across all affected Office channels (Microsoft 365 Apps, Office LTSC, and any standalone Office 2016/2019/2021/2024 builds listed by MSRC) using Windows Update, WSUS, Microsoft Intune, or Click-to-Run channel updates as appropriate. Until patches are deployed, reduce exposure by enabling Protected View for documents from the Internet and Outlook attachments, enforcing Office macro-blocking policies (Block macros from running in Office files from the Internet), enabling Attack Surface Reduction rules for Office child-process and child-content creation, and stripping or sandboxing inbound Office attachments at the mail gateway - note these controls degrade user experience for legitimate external documents and do not address documents delivered via trusted shares. Cross-reference https://vuldb.com/vuln/369655 for any additional mitigation guidance.