What is the CVSS score of CVE-2026-45645?

CVE-2026-45645 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Office are affected by CVE-2026-45645?

CVE-2026-45645 affects Microsoft Office and enables arbitrary code execution when users open malicious documents without requiring special account privileges; no public exploit identified at time of…. A patch is available.

How to fix or mitigate CVE-2026-45645?

24 hours: Issue security alert to all Office users; disable or restrict external document processing for high-risk departments. 7 days: Implement application whitelisting or require Office documents be processed in sandboxed environments; disable Office macros organization-wide if operationally feasible. 30 days: Continuously monitor Microsoft Security Response Center (MSRC) advisories for CVE-2026-45645 patch release; prepare patch deployment procedures; evaluate advanced threat protection tools with Office integration.

Microsoft Office CVE-2026-45645

EUVD-2026-35691 HIGH

Untrusted Pointer Dereference (CWE-822)

2026-06-09 secure@microsoft.com

GHSA-wxr3-p34c-5p9q

Microsoft Buffer Overflow 365 Apps Microsoft 365 Office 2016 Office 2019 Office 2021 Office 2024

7.8

CVSS 3.1 · Vendor: microsoft

Temporal: 6.8

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 18:03 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Office is possible through a heap-based buffer overflow (CWE-822) that triggers when a user opens a maliciously crafted document. The CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R) reflects a classic client-side file-format attack requiring user interaction but no prior authentication, yielding full confidentiality, integrity, and availability impact on the targeted workstation. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but Office document parsers are historically high-value targets and the vulnerability was reported by Microsoft's own MSRC team.

Technical ContextAI

The flaw is categorized as CWE-822 (Untrusted Pointer Dereference) manifesting as a heap-based buffer overflow within Microsoft Office's document parsing components. Office processes a wide range of complex binary and OOXML structures (DOCX, XLSX, PPTX, RTF, legacy OLE compound files), and heap corruption in these parsers typically stems from malformed length fields, embedded objects, or font/graphics records that cause the parser to write past an allocated heap chunk or follow an attacker-controlled pointer. Successful exploitation usually leverages this corruption to overwrite function pointers, vtable entries, or adjacent heap metadata to redirect execution. Because CPE data was not supplied in the input, the specific Office channels (Microsoft 365 Apps, Office LTSC 2021/2024, Office for Mac) and exact builds must be confirmed against the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45645.

RemediationAI

Apply the Microsoft security update referenced on the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45645 as part of the next Patch Tuesday cycle; exact fixed build numbers are not included in the supplied input and must be pulled from that advisory. For Microsoft 365 Apps, ensure devices are on the Current Channel or Monthly Enterprise Channel and trigger the Office update via 'File > Account > Update Options > Update Now' or via Configuration Manager/Intune. Until patched, compensating controls include ensuring Protected View remains enabled for files from the internet, Outlook, and unsafe locations (which sandboxes the parser and typically defeats this class of bug at the cost of forcing users to click 'Enable Editing' for legitimate documents), enforcing Attack Surface Reduction rules that block Office child-process creation and executable content from email, and using Microsoft Defender for Office 365 Safe Attachments to detonate inbound files in a sandbox. Blocking legacy formats (RTF, .doc, .xls) via the File Block Settings group policy further reduces the parser attack surface but will disrupt users who exchange older documents.