What is the CVSS score of EUVD-2026-35540?

EUVD-2026-35540 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Word are affected by EUVD-2026-35540?

Microsoft Office Word contains a code execution vulnerability (CVE-2026-45457) that allows attackers to compromise systems when users open malicious documents, with potential impacts to data…. A patch is available.

How to fix or mitigate EUVD-2026-35540?

Within 24 hours: Enable email gateway filtering to block or sandbox Word attachments and issue a user advisory against opening unsolicited documents. Within 7 days: Deploy endpoint detection and response (EDR) monitoring for abnormal Word process execution and memory manipulation attempts. Within 30 days: Monitor Microsoft security advisories and CISA channels for CVE-2026-45457 patch availability, prepare testing environments for evaluation, and develop a staged deployment plan for Microsoft Office updates once released.

Microsoft Word EUVD-2026-35540

| CVE-2026-45457 HIGH

Out-of-bounds Read (CWE-125)

2026-06-09 secure@microsoft.com

GHSA-9wv7-96q7-32pc

Information Disclosure Microsoft Buffer Overflow 365 Apps Microsoft 365 Office 2021 Office 2024

7.8

CVSS 3.1 · Vendor: microsoft

Temporal: 6.8

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:26 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.8

DescriptionCVE.org

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Office Word is possible through an untrusted pointer dereference (CWE-125 out-of-bounds read) that an attacker can trigger by convincing a user to open a malicious document. The CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R) reflects high impact to confidentiality, integrity, and availability once the booby-trapped file is opened, though no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The flaw resides in Microsoft Office Word's document parsing logic, where an untrusted pointer dereference - categorized under CWE-125 (Out-of-bounds Read) - occurs when processing malformed document structures. Office's complex binary (DOC) and OOXML (DOCX/RTF) parsers historically expose memory-safety bugs because they reconstruct pointer-rich object graphs from attacker-controlled byte streams; a missing bounds check or trust assumption on an embedded offset can cause Word to dereference a pointer derived from file data. Combined with the 'Buffer Overflow' and 'Information Disclosure' tags reported, this strongly suggests a memory-corruption primitive in the parser that yields both read-out-of-bounds (info disclosure) and ultimately arbitrary code execution in the Word process context.

RemediationAI

Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45457 as soon as it is published for your Office channel (Patch available per vendor advisory; exact fix build not provided in the input data). Until the patch is deployed, keep Protected View enabled for documents from the Internet, email attachments, and unsafe locations (trade-off: users must explicitly click 'Enable Editing' on legitimate documents), and consider enforcing Office's Attack Surface Reduction rules that block Win32 API calls from Office macros and block Office from creating child processes (trade-off: may break legitimate automation and add-ins). For high-risk users, block inbound Word documents at the email gateway or convert them to PDF before delivery (trade-off: workflow disruption for users who legitimately exchange .docx/.doc/.rtf files).