What is the CVSS score of CVE-2026-45474?

CVE-2026-45474 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Office are affected by CVE-2026-45474?

Microsoft Office (CVE-2026-45474, CVSS 8.4) is vulnerable to unauthenticated local code execution affecting all users with system access, creating risk of unauthorized data access and system…. A patch is available.

How to fix or mitigate CVE-2026-45474?

24 hours: Inventory all Microsoft Office installations and assess systems where untrusted users may have local access. 7 days: Deploy application control policies for Office executables, implement file system access controls to restrict malicious Office file loading from user-writable locations, and enable process execution audit logging. 30 days: Monitor Microsoft security advisories for patch availability; upon release, plan phased deployment starting with critical systems.

Microsoft Office CVE-2026-45474

EUVD-2026-35650 HIGH

Use After Free (CWE-416)

2026-06-09 secure@microsoft.com

GHSA-x663-mm3m-f5wg

Microsoft Use After Free Memory Corruption Buffer Overflow 365 Apps 365 Copilot Microsoft 365 Office 2016 Office 2019 Office 2021 Office 2024

8.4

CVSS 3.1 · Vendor: microsoft

Temporal: 7.3

Severity by source

Vendor (microsoft) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

7.3 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:23 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 8.4

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Office is possible through a heap-based buffer overflow that an unauthorized attacker can trigger without user interaction. The flaw carries a CVSS 3.1 score of 8.4 with high impact across confidentiality, integrity, and availability, and no public exploit identified at time of analysis. Despite requiring local access, the absence of authentication and user-interaction requirements makes this a notable priority for endpoint patching cycles.

Technical ContextAI

The vulnerability resides in Microsoft Office, a productivity suite that parses numerous complex document formats (DOCX, XLSX, PPTX, RTF, and legacy OLE-based files) through native C/C++ parsing components prone to memory-safety errors. The associated CWE-416 (Use After Free) class, reinforced by vendor tagging that also references heap-based buffer overflow and memory corruption, indicates the bug arises when Office code dereferences or writes to a heap chunk whose backing object has already been freed, enabling controlled heap layout manipulation and ultimately attacker-controlled code execution. Because Office runs in the security context of the invoking user, successful exploitation yields code execution at that user's privilege level, with subsequent risk of privilege escalation through chained techniques.

RemediationAI

Apply the security update referenced in Microsoft's MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45474 as soon as the patch is staged; the input data does not specify an exact fix build, so administrators should consult MSRC for the precise Click-to-Run, MSI, and Office LTSC/365 build numbers (Patch available per vendor advisory). Until updates are deployed, restrict opening of untrusted Office documents by enforcing Protected View for files originating from the internet and Outlook, enable Attack Surface Reduction rules that block Office child-process creation and Win32 API calls from macros, and consider Mark-of-the-Web enforcement plus disabling legacy file formats via Trust Center File Block Settings; these mitigations may break workflows that depend on macros or legacy binary formats and should be tested. Endpoint exploit-mitigation features such as CFG, ACG, and EAF available through Exploit Protection and Microsoft Defender for Endpoint can raise the bar against successful CWE-416 exploitation but are not substitutes for the patch.