What is the CVSS score of CVE-2026-45485?

CVE-2026-45485 has a contested CVSS base score of 3.3 from a third party (e.g. CISA-ADP), while the vendor rates it Low. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-45485?

Yes, a patch is available for CVE-2026-45485. Update the affected software to the latest version immediately.

Microsoft Office CVE-2026-45485

EUVD-2026-35653 LOW

Out-of-bounds Read (CWE-125)

2026-06-09 secure@microsoft.com

GHSA-65pp-9wwq-5r3x

Information Disclosure Microsoft Buffer Overflow 365 Apps Microsoft 365 Office 2016 Office 2019 Office 2021 Office 2024 Sharepoint Server

Low

Disputed · 3.3 Vendor: microsoft

Severity by source

Sources disagree (Low–High)

Vendor (microsoft) PRIMARY

3.3 LOW

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

ENISA EUVD

HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:44 vuln.today

Patch available

Jun 09, 2026 - 19:03 EUVD

DescriptionCVE.org

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

AnalysisAI

Out-of-bounds read in Microsoft Office and SharePoint Server exposes low-level memory contents to a local attacker when a victim opens a crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office 2016/2019/LTSC 2021/2024, Office for Mac variants, and SharePoint Server 2016/2019/Subscription Edition - all at version 16.0.x baselines. The CVSS score of 3.3 (Low) reflects constrained impact: confidentiality is only partially affected, integrity and availability are untouched, and exploitation requires both local access and user interaction. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

CWE-125 (Out-of-Bounds Read) describes a class of memory safety flaw where a parsing or processing routine reads beyond the boundary of an allocated memory buffer, returning data from adjacent memory regions that may contain sensitive content such as stack canaries, heap metadata, or application state. The 'Buffer Overflow' tag in the EUVD entry is technically imprecise - CWE-125 is a read-only overreach, not a write overflow (CWE-122); this distinction is material because OOB reads are generally not directly exploitable for code execution. The vulnerability resides in the Microsoft Office document processing layer, common to 16.0.x builds of desktop Office (365 Apps, 2016, 2019, LTSC 2021/2024), Office for Mac (365, LTSC 2021/2024), and Microsoft SharePoint Server (2016, 2019, Subscription Edition). The breadth across SharePoint suggests the affected parsing component may be a shared Office library used both by client apps and server-side document rendering.

RemediationAI

Apply vendor-released patches available through the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45485. For Microsoft Office 2016 and SharePoint Enterprise Server 2016, update to build 16.0.5556.1005 or later. For SharePoint Server 2019, update to 16.0.10417.20153 or later. For SharePoint Server Subscription Edition, update to 16.0.19725.20384 or later. For Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, and Office LTSC 2024, apply the latest updates via the Office release channel at https://aka.ms/OfficeSecurityReleases; specific build numbers for these products are not enumerated in the available data. For Microsoft Office and LTSC for Mac variants (365, 2021, 2024), consult the same release page, as specific fix builds were not enumerated. Given the local-only, user-interaction-required attack vector and low severity, this patch can typically be scheduled within normal monthly patching cycles rather than as an emergency deployment. No documented workaround is available that would fully mitigate the underlying OOB read without applying the patch.