CVE-2026-45460CriticalRevised 19 Jun
Microsoft Office Information Disclosure Vulnerability
Assessment
Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information locally.
- Severity
- Critical
- CVSS base score
- 4.7CVSS:3.1/
AV:L/ AC:H/ PR:N/ UI:R/ S:U/ C:H/ I:N/ A:N/ E:U/ RL:O/ RC:C - Impact
- Information Disclosure
- EPSS, next 30 days
- 0.4%Higher than 33.5% of scored CVEs · FIRST model run 29 Sep 2026 · about EPSS
- Public exploit code
- No Nuclei template lists it
- Exploitability
- Exploitation Unlikely
- Publicly disclosed
- No
- Customer action
- Required: apply the update
- Component
- Microsoft Office
- Weakness
- CWE-126: Buffer Over-read
- Issued by
- Microsoft
- Published
- 9 Jun 2026 · June 2026
- Last revised
- 19 Jun 2026Microsoft is announcing the availability of the security updates for Microsoft Office for Android. Customers running affected Microsoft Office for Android software should install the update for their product to be protected from this vulnerability.
Updates that fix it
0 KBsNo KB listed
MSRC lists no downloadable update, which usually means a service-side fix or a release-notes update. Check the MSRC advisory.
Affected products
Microsoft Office12 affected products
- Microsoft 365 Apps for Enterprise for 32-bit Systems
- Microsoft 365 Apps for Enterprise for 64-bit Systems
- Microsoft Office 2019 for 32-bit editions
- Microsoft Office 2019 for 64-bit editions
- Microsoft Office 365 for Mac
- Microsoft Office for Android
- Microsoft Office LTSC 2021 for 32-bit editions
- Microsoft Office LTSC 2021 for 64-bit editions
- Microsoft Office LTSC 2024 for 32-bit editions
- Microsoft Office LTSC 2024 for 64-bit editions
- Microsoft Office LTSC for Mac 2021
- Microsoft Office LTSC for Mac 2024