What is the CVSS score of EUVD-2026-35648?

EUVD-2026-35648 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Office are affected by EUVD-2026-35648?

Microsoft Office contains a high-severity vulnerability (CVE-2026-45472, CVSS 8.4) that could enable code execution on user workstations when processing malicious documents.. A patch is available.

How to fix or mitigate EUVD-2026-35648?

Within 24 hours: Inventory Microsoft Office deployments across the organization and document current patch and version status. Within 7 days: Deploy compensating controls organization-wide (disable Office macro execution, restrict document execution from untrusted sources, apply Group Policy security baselines). Within 30 days: Monitor Microsoft security advisories for patch availability and establish expedited deployment procedures if patch is released.

Microsoft Office EUVD-2026-35648

| CVE-2026-45472 HIGH

Use After Free (CWE-416)

2026-06-09 secure@microsoft.com

GHSA-7rc8-chgg-9grf

Microsoft Use After Free Memory Corruption Buffer Overflow 365 Apps 365 Copilot Microsoft 365 Office 2016 Office 2019 Office 2021 Office 2024

8.4

CVSS 3.1 · Vendor: microsoft

Temporal: 7.3

Severity by source

Vendor (microsoft) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

7.3 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:23 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 8.4

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Office via a heap-based buffer overflow allows an unauthorized attacker to run arbitrary code with the privileges of the user opening a malicious document. The CVSS vector (AV:L/PR:N/UI:N) indicates local attack vector without required authentication or user interaction, an unusual combination that warrants verification against the vendor advisory. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.

Technical ContextAI

Microsoft Office is a productivity suite (Word, Excel, PowerPoint, Outlook) that parses complex binary and OOXML document formats through native C/C++ parsing components. The root cause is classified as CWE-416 (Use After Free), though the description characterizes the issue as a heap-based buffer overflow - both are memory-corruption classes where freed or out-of-bounds heap memory is referenced, allowing an attacker to overwrite adjacent heap structures (vtables, function pointers) and pivot control flow. The associated tags (Buffer Overflow, Use After Free, Memory Corruption) suggest the bug is a parsing flaw in an Office file-format handler, which historically has been a productive surface for both crash-to-RCE exploits and Office-document-borne malware.

RemediationAI

Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45472 via Microsoft Update, WSUS, Intune, or your standard Office update channel (Click-to-Run for Microsoft 365 Apps, MSI for volume-licensed editions). Until patches are deployed, compensating controls include enabling Protected View for documents originating from the internet and email attachments (which sandboxes the parser and blocks active content but degrades usability for users who routinely edit untrusted files), blocking high-risk legacy file formats at the email gateway, and enabling Attack Surface Reduction rules such as 'Block Office applications from creating child processes' and 'Block executable content from email client and webmail' (which can break legitimate macro-driven workflows). Application Guard for Office, where licensed, provides hardware-isolated containment of untrusted documents.