What is the CVSS score of CVE-2026-45461?

CVE-2026-45461 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Office are affected by CVE-2026-45461?

Microsoft Office users face a code execution vulnerability (CVE-2026-45461, CVSS 8.4) that could allow attackers with local system access to compromise user accounts and systems through malicious…. A patch is available.

How to fix or mitigate CVE-2026-45461?

Within 24 hours: Send security alert to all staff regarding CVE-2026-45461; conduct inventory of Microsoft Office installations to establish baseline exposure (query asset management systems or deploy configuration audits). Within 7 days: Configure Office macro security policies (set macro security to 'Disable all macros except digitally signed' via Group Policy for Windows environments); enable Windows Defender Attack Surface Reduction rules targeting Office document execution. Within 30 days: Establish monitoring for Microsoft security advisories; develop patch deployment and testing procedures; review and strengthen email gateway filtering for Office document attachments from external sources.

Microsoft Office CVE-2026-45461

EUVD-2026-35671 HIGH

Use After Free (CWE-416)

2026-06-09 secure@microsoft.com

GHSA-3c5w-7g69-r2hm

Microsoft Use After Free Memory Corruption Buffer Overflow 365 Apps 365 Copilot Microsoft 365 Office 2016 Office 2019 Office 2021 Office 2024

8.4

CVSS 3.1 · Vendor: microsoft

Temporal: 7.3

Severity by source

Vendor (microsoft) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

7.3 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 18:25 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 8.4

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Office via a heap-based buffer overflow that lets an unauthorized attacker run arbitrary code in the context of the current user. The flaw carries a CVSS 8.4 rating driven by high impact across confidentiality, integrity, and availability, and no public exploit identified at time of analysis. Despite the 'unauthorized' wording, the CVSS vector specifies a local attack vector, indicating the attacker must already be able to deliver a crafted file or run code on the target system.

Technical ContextAI

The vulnerability resides in Microsoft Office's document parsing or rendering components, where memory is allocated on the heap to process structured document content. CWE-416 (Use After Free) is the root cause class, which combined with the tags 'Heap-based Buffer Overflow' and 'Memory Corruption' suggests a dangling pointer is dereferenced after the underlying heap chunk has been freed and reallocated, enabling adjacent heap memory corruption. Microsoft Office's complex parsers for formats such as Word, Excel, and PowerPoint historically expose this class of bug because they handle nested object streams, embedded objects, and legacy binary formats where object lifetime management is intricate. The reporting source (secure@microsoft.com) indicates Microsoft itself is the coordinating vendor; no CPE strings were provided in this dataset to pinpoint exact product editions.

RemediationAI

Patch availability is not explicitly stated in the input but MSRC advisories typically accompany Patch Tuesday releases, so treat this as Patch available per vendor advisory and apply the corresponding Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45461 as soon as it is released for your Office channel. As compensating controls until patching completes, disable the Outlook and Explorer preview panes for Office document types to prevent triggering UI:N-style auto-rendering, enforce Protected View for files originating from the Internet and Outlook attachments (which sandboxes the parser), and configure Attack Surface Reduction rules to block Office applications from creating child processes and to block Win32 API calls from Office macros. Mark of the Web propagation must be preserved for these mitigations to function; the trade-off is that legitimate users who routinely edit documents from external sources will see additional prompts and reduced functionality in preview surfaces.