What is the CVSS score of CVE-2026-45458?

CVE-2026-45458 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Office are affected by CVE-2026-45458?

Microsoft Office contains a use-after-free vulnerability (CVE-2026-45458, CVSS 8.4) permitting local attackers to execute arbitrary code without user interaction or elevated privileges, creating risk…. A patch is available.

How to fix or mitigate CVE-2026-45458?

Within 24 hours: inventory Office deployments and assess user base at risk; restrict local access controls and disable unnecessary Office features pending mitigation. Within 7 days: deploy endpoint detection and response (EDR) tools with Office process monitoring; conduct security briefings to staff on risks from local code execution. Within 30 days: evaluate Office version consolidation and hardening opportunities; establish ongoing monitoring for vendor security advisories and patch availability.

Microsoft Office CVE-2026-45458

EUVD-2026-35669 HIGH

Use After Free (CWE-416)

2026-06-09 secure@microsoft.com

GHSA-5632-qjr7-ch9q

Microsoft Authentication Bypass Use After Free Memory Corruption 365 Apps Microsoft 365 Office 2019 Office 2021 Office 2024 Sharepoint Server Word

8.4

CVSS 3.1 · Vendor: microsoft

Temporal: 7.3

Severity by source

Vendor (microsoft) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

7.3 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 18:26 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 8.4

DescriptionCVE.org

Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Office via a type confusion flaw (CWE-416) permits unauthorized attackers to run arbitrary code in the context of the Office process without requiring privileges or user interaction. The issue carries a high CVSS 3.1 score of 8.4 with full impact across confidentiality, integrity, and availability, though exploitation requires local attack vector access to the target system. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

The vulnerability resides in Microsoft Office and stems from CWE-416 (Use After Free), which the description frames as a 'type confusion' - access of a resource using an incompatible type. In practice this means Office code dereferences memory through a pointer whose object type no longer matches the actual freed/reallocated memory contents, allowing controlled corruption of object internals, vtables, or function pointers. Successful exploitation of such memory corruption flaws in Office typically leads to arbitrary code execution within the Office process sandbox. The provided tags (Use After Free, Memory Corruption, Authentication Bypass) reinforce that this is a classic memory-safety defect rather than a logic flaw, and no CPE data was supplied to pin exact affected SKUs or builds.

RemediationAI

Patch available per vendor advisory: apply the Microsoft security update referenced in the MSRC entry at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45458 for each affected Office channel and SKU as soon as the patch is validated in your environment. Because no exact fix build was provided in the input data, administrators should consult the MSRC update guide to identify the specific KB or build for Microsoft 365 Apps, Office LTSC, and standalone Office versions before deployment. Compensating controls while patching is in flight include enabling Protected View and Application Guard for Office to contain document-borne triggers, blocking untrusted Office macros via Group Policy (trade-off: may break legitimate macro-based workflows), and restricting which low-privileged local processes can interact with Office via AppLocker or WDAC (trade-off: requires careful allowlisting to avoid breaking add-ins). The VulDB entry at https://vuldb.com/vuln/369666 may offer additional context as detail becomes public.