VulnSocial

CVE-2026-45458PoC(microsoft / 365_apps)

LOWCVSS 8.4 · HIGH

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

  • Patch microsoft 365_apps systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

microsoft CVEsBack to dashboard
2.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-416

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • 365_apps
  • microsoft_365
  • office_2019
  • office_2021

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 5 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 2 signals
  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 5 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-06-12); latest day: 2
  • 5 total mentions across 3 days

Affected systems

Vendors
microsoft
Products
365_appsmicrosoft_365office_2019office_2021office_2024sharepoint_serverword

3 versions affected across 7 products

Deep dive

Activity timeline5 mentions / 3d
01122Mentions · 2026-06-10: 1Mentions · 2026-06-12: 2Mentions · 2026-06-13: 2PoC Mentioned / Linked · 2026-06-10: 1PoC Mentioned / Linked · 2026-06-13: 1Patch / Workaround · 2026-06-10: 1Patch / Workaround · 2026-06-12: 1Patch / Workaround · 2026-06-13: 1Technical Details · 2026-06-10: 1Technical Details · 2026-06-12: 2Technical Details · 2026-06-13: 206-1006-1206-13
Signal classification3 categories
PoC
240.0%
Patch
240.0%
Disclosure
120.0%
Referenced assets6 URLs
Classification over time
DateTotalLabels
2026-06-101
PoC1
2026-06-122
Disclosure1Patch1
2026-06-132
Patch1PoC1
Full discourse5 posts
  • PatchPoint.Official@_patchpoint_
    PoC

    We released a demo video for the CVE-2026-45458 Microsoft Outlook and Word Remote Code Execution Vulnerability, patched by Microsoft in Jun 2026. Watch the video and subscribe to our private vulnerability PoC and detailed report service at http://Patchpoint.io. You can also check it at the following link: https://youtu.be/AgKhh3bvD8Y #Windows #Microsoft #Word #Outlook #Critical #Vulnerability #CVE_2026_45458

    Post summary

    A demo video revealing the CVE‑2026‑45458 RCE vulnerability and the Microsoft patch is released, and the post advertises a private PoC service.

    02065552
    489 followersView on X
  • Cyber Edition@CyberEdition
    Patch

    ⚠️ Microsoft patched 3 critical Outlook and Word RCE flaws (CVE-2026-45456, CVE-2026-45458, CVE-2026-47635). Even Outlook’s Preview Pane can trigger exploitation without opening an attachment. Organizations should patch immediately. #Microsoft https://thecyberedition.com/critical-microsoft-outlook-word-rce-flaws-patch-now/

    Post summary

    Microsoft released patches for three critical Outlook and Word RCE vulnerabilities that could be exploited through the Preview Pane, urging organizations to apply the fixes immediately.

    0001086
    736 followersView on X
  • ThreatAft@ThreatAft
    PoC

    🔐 CRITICAL: Outlook & Word RCE zero‑days Preview Pane = attack vector. No click required. Just previewing an email triggers code execution. CVE-2026-47635, CVE-2026-45458, CVE-2026-45456 — CVSS 8.4 🔗 https://threataft.com/articles/outlook-word-preview-pane-rce-cve-2026-47635-45458 #CyberSecurity #ThreatIntel #infosec #PatchTuesday

    Post summary

    The post announces critical Outlook/Word RCE zero‑days, lists CVEs and CVSS scores, and supplies a link likely containing PoC details.

    0000156
    29 followersView on X
  • The Daily Tech Feed@dailytechonx
    Patch

    Microsoft has patched critical RCE vulnerabilities in Outlook and Word, identified as CVE-2026-45456, CVE-2026-45458, and CVE-2026-47635. These flaws could allow attackers to execute arbitrary code via specially crafted emails. Users should update their Office installations immediately to mitigate potential risks. #Microsoft #Outlook #Word #RCE #CyberSecurity #Vulnerabilities https://thedailytechfeed.com/critical-vulnerabilities-in-microsoft-outlook-and-word-allow-remote-code-execution/

    Post summary

    Microsoft released patches for three critical RCE flaws in Outlook and Word; users should update their Office suite immediately to mitigate risks.

    0000040
    389 followersView on X
  • ThreatCluster@threatcluster
    Disclosure

    Microsoft disclosed three high-severity remote code execution bugs in Outlook and Word, CVE-2026-45456, CVE-2026-45458 and CVE-2026-47635, each rated CVSS 8.4, in a 9 June security advisory, Microsoft said. https://threatcluster.io/cluster/critical-rce-vulnerabilities-found-in-microsoft-outlook-and--0ac29809

    Post summary

    Microsoft announced three new high‑severity remote code execution vulnerabilities in Outlook and Word (CVE-2026-45456, CVE-2026-45458, CVE-2026-47635) with CVSS scores of 8.4.

    0000055
    330 followersView on X
CPE platform detail16 entries

16 of 16 entries

PartVendorProductVersionTarget SWTarget HW
Appmicrosoft365_apps--x64
Appmicrosoft365_apps--x86
Appmicrosoftmicrosoft_365-macos-
Appmicrosoftoffice_2019--x64
Appmicrosoftoffice_2019--x86
Appmicrosoftoffice_2021--x64
Appmicrosoftoffice_2021--x86
Appmicrosoftoffice_2021-macos-
Appmicrosoftoffice_2024--x64
Appmicrosoftoffice_2024--x86
Appmicrosoftoffice_2024-macos-
Appmicrosoftsharepoint_server---
Appmicrosoftsharepoint_server2016--
Appmicrosoftsharepoint_server2019--
Appmicrosoftword2016-x64
Appmicrosoftword2016-x86

Explore more

Back to dashboardmicrosoft CVEs365_apps vulnerabilities