EUVD-2026-35671
GHSA-3c5w-7g69-r2hm
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office via a heap-based buffer overflow that lets an unauthorized attacker run arbitrary code in the context of the current user. The flaw carries a CVSS 8.4 rating driven by high impact across confidentiality, integrity, and availability, and no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must process a crafted Office document with a vulnerable version of Microsoft Office installed; the CVSS local attack vector (AV:L) means the malicious file must reach the endpoint, but UI:N indicates no explicit user 'Open' action is needed - exploitation can plausibly fire through preview-pane rendering, Windows Search indexing, or other automatic parsing pathways. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H represents a notable inconsistency that defenders must reconcile: AV:L means the attack vector is local (file open, local process), yet UI:N claims no user interaction is required - for Office bugs this combination typically implies exploitation through a preview pane, indexer, or auto-processing pipeline rather than an explicit user-initiated 'Open' action. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker emails a crafted Office document to a target whose mail client renders attachments in a preview pane or whose endpoint indexer parses incoming files; processing the malformed structure triggers the use-after-free, corrupts a heap object, and hijacks control flow to execute attacker-supplied shellcode in the user's security context. No public exploit identified at time of analysis, but the bug class is well-understood and Office heap-UAF primitives have historically been weaponized within months of disclosure. |
| Remediation | Patch availability is not explicitly stated in the input but MSRC advisories typically accompany Patch Tuesday releases, so treat this as Patch available per vendor advisory and apply the corresponding Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45461 as soon as it is released for your Office channel. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Send security alert to all staff regarding CVE-2026-45461; conduct inventory of Microsoft Office installations to establish baseline exposure (query asset management systems or deploy configuration audits). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (C
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). A
Use-after-free vulnerability in Microsoft Office PowerPoint that allows an unauthenticated local attacker to execute arb
Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally.
Microsoft Office Word contains an out-of-bounds read vulnerability that enables local code execution on affected systems
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. [CVSS 8.4 HIGH]
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. [CVSS 8.4 HIGH]
Local code execution in Microsoft Office Word arises from an untrusted pointer dereference (CWE-822) that can be trigger
Local code execution in Microsoft Office Word is possible when a user opens a maliciously crafted document that triggers
Same weakness CWE-416 – Use After Free
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today