Microsoft Patches Outlook Preview Pane and Word RCE Flaws
Vulnerability Disclosure · 4 sources · Updated 4mo ago · First seen Jul 7, 2026
Microsoft released June 2026 security updates that include fixes for three critical remote code execution vulnerabilities in Outlook and Word: CVE-2026-45456, CVE-2026-45458, and CVE-2026-47635. The flaws were described as memory-safety issues in the Word rendering engine, which Outlook Classic uses to render email content, creating a no-click attack path through the Outlook Preview Pane. Microsoft assigned each issue a CVSS score of 8.4 and said no active exploitation had been observed at the time of disclosure.
The vulnerabilities affect supported Microsoft Office and Outlook builds, including Office LTSC 2024, and were addressed as part of Microsoft’s June Patch Tuesday releases highlighted by multiple security advisories. Reporting on the updates urged organizations to prioritize patch deployment, especially for systems running Outlook Classic and Word, and to consider temporary risk reduction measures such as disabling the Preview Pane in high-risk environments while monitoring for suspicious Office-related process activity.
