What is the CVSS score of EUVD-2026-35649?

EUVD-2026-35649 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Word are affected by EUVD-2026-35649?

Microsoft Word contains a local code execution vulnerability (CVE-2026-45471, CVSS 7.8) that executes arbitrary code when users open specially crafted documents.. A patch is available.

How to fix or mitigate EUVD-2026-35649?

Within 24 hours: Alert all users to avoid opening documents from untrusted sources and enable Word Protected View. Within 7 days: Complete inventory of Word installations and implement document execution policies; consider disabling macros if operationally feasible. Within 30 days: Monitor Microsoft MSRC Security Update Guide for patch availability and prepare deployment procedures.

Microsoft Word EUVD-2026-35649

| CVE-2026-45471 HIGH

Untrusted Pointer Dereference (CWE-822)

2026-06-09 secure@microsoft.com

GHSA-j65q-5x75-rjwv

Authentication Bypass Microsoft 365 Apps Microsoft 365 Office 2019 Office 2021 Office 2024 Sharepoint Server Word

7.8

CVSS 3.1 · Vendor: microsoft

Temporal: 6.8

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:24 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.8

DescriptionCVE.org

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Office Word enables an attacker to run arbitrary code in the context of the current user by tricking them into opening a malicious document that triggers an untrusted pointer dereference. With a CVSS 7.8 score and no public exploit identified at time of analysis, the flaw is exploited locally but unauthenticated, relying on user interaction to open a crafted file. Microsoft has issued an advisory via the MSRC Security Update Guide.

Technical ContextAI

The root cause is CWE-822 (Untrusted Pointer Dereference), a memory-safety class in which the application reads a pointer value from attacker-controlled input (such as a crafted Word document structure) and dereferences it without validation. In Office parsers, this typically occurs when serialized structures (OLE streams, RTF objects, embedded objects, or document part records) contain pointer-like fields or offsets that are used directly. Successful dereference of an attacker-chosen address allows hijacking control flow or corrupting memory, leading to code execution in the Word process - which runs at the user's privilege level on Windows. The CPE-equivalent target is Microsoft Office Word (versions enumerated in the MSRC advisory referenced in the input).

RemediationAI

Apply the security update referenced in Microsoft's MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45471 for the specific Word/Office channel deployed (Click-to-Run, MSI, or Mac); exact patched build numbers are listed on that page and should be cross-checked against installed versions via Office Account → About Word. As compensating controls until patches are deployed, configure Protected View to remain enabled for files originating from the Internet, OneDrive, and email attachments (default but sometimes disabled in enterprise GPO - disabling Protected View is the most common exposure for this class), and enable Attack Surface Reduction rule 'Block Office applications from creating child processes' and 'Block Win32 API calls from Office macros' to constrain post-exploitation; trade-off is occasional breakage of legitimate Office automation workflows. Block inbound .doc/.docx/.rtf attachments at the mail gateway from untrusted senders or rewrite them to PDF, accepting the productivity friction.