What is the CVSS score of CVE-2026-45475?

CVE-2026-45475 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Office are affected by CVE-2026-45475?

A heap-based buffer overflow in Microsoft Office enables local code execution when users open crafted documents, affecting confidentiality, integrity, and availability with CVSS 7.8 severity.. A patch is available.

How to fix or mitigate CVE-2026-45475?

Within 24 hours: Establish monitoring for Microsoft Security Response Center (MSRC) updates on CVE-2026-45475; brief IT leadership on patch timeline gaps. Within 7 days: Deploy email security rules to identify and quarantine suspicious Office documents from external sources; distribute user awareness bulletin on document origin verification. Within 30 days: No vendor-released patch identified at time of analysis-maintain readiness for immediate deployment upon release; implement endpoint detection rules for exploitation attempts; document scope across Office versions 2016, 2019, and Office 365 environments.

Microsoft Office CVE-2026-45475

EUVD-2026-35647 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-09 secure@microsoft.com

GHSA-fq8x-mrpc-mqxw

Heap Overflow Microsoft Buffer Overflow 365 Apps Microsoft 365 Office 2016 Office 2019 Office 2021 Office 2024 Sharepoint Server

7.8

CVSS 3.1 · Vendor: microsoft

Temporal: 6.8

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:22 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Office is possible through a heap-based buffer overflow (CWE-122) that an unauthenticated attacker can trigger when a user opens a crafted document. The CVSS 3.1 base score of 7.8 reflects high impact to confidentiality, integrity, and availability, with required user interaction limiting mass exploitation. There is no public exploit identified at time of analysis and the issue is not currently listed on the CISA KEV catalog.

Technical ContextAI

The flaw is a heap-based buffer overflow (CWE-122), a memory-safety defect in which a write past the bounds of a heap-allocated buffer corrupts adjacent metadata or object pointers in the process heap of Microsoft Office. Office's document parsers (Word, Excel, PowerPoint and their shared rich-text/OLE/structured-storage components) routinely deserialize complex binary structures, and a length-validation or arithmetic flaw in one of these parsers is the typical root cause of this CWE class. Successful corruption of heap metadata or vtable pointers can be leveraged to redirect control flow and achieve arbitrary code execution within the context of the Office process. CPE strings were not provided in the input, so the exact Office editions and channels affected must be derived from the Microsoft Security Response Center advisory.

RemediationAI

Patch available per vendor advisory - apply the Microsoft security update for CVE-2026-45475 published on the Microsoft Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45475 across all Office installations (Microsoft 365 Apps, Office LTSC, and any supported perpetual Office releases listed by Microsoft); the input does not specify exact KB or build numbers, so consult the advisory for the authoritative fixed builds. Until patches are deployed, reduce exposure by enforcing Protected View for files originating from the internet and other untrusted locations, blocking or stripping Office documents from external email at the gateway, and configuring Attack Surface Reduction rules and Office macro/Mark-of-the-Web policies - these mitigations may inconvenience users who legitimately receive external documents and can break workflows that disable Protected View by policy. Defender for Endpoint or equivalent EDR with exploit-protection rules for Office processes (e.g., child-process and DLL-injection guards) provides additional containment with low operational cost.