Loading story…
Microsoft released June 2026 security updates that include fixes for three critical remote code execution vulnerabilities in Outlook and Word: CVE-2026-45456, CVE-2026-45458, and CVE-2026-47635. The flaws were described as memory-safety issues in the Word rendering engine, which Outlook Classic uses to render email content, creating a no-click attack path through the Outlook Preview Pane. Microsoft assigned each issue a CVSS score of 8.4 and said no active exploitation had been observed at the time of disclosure.
The vulnerabilities affect supported Microsoft Office and Outlook builds, including Office LTSC 2024, and were addressed as part of Microsoft’s June Patch Tuesday releases highlighted by multiple security advisories. Reporting on the updates urged organizations to prioritize patch deployment, especially for systems running Outlook Classic and Word, and to consider temporary risk reduction measures such as disabling the Preview Pane in high-risk environments while monitoring for suspicious Office-related process activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
At the time of the 2026-06-09 disclosure, Microsoft stated it had not observed active exploitation of CVE-2026-45456, CVE-2026-45458, and CVE-2026-47635. All three vulnerabilities were assigned CVSS v3.1 scores of 8.4.
On 2026-06-09, Microsoft disclosed and patched three critical remote code execution vulnerabilities: CVE-2026-45456, CVE-2026-45458, and CVE-2026-47635. The flaws affect the Word rendering engine used by Outlook Classic, making the Outlook Preview Pane a no-click attack vector.
On 2026-03-10, Microsoft’s March 2026 vulnerability cycle was released, covering 86 CVEs including 10 Critical flaws and two publicly disclosed zero-days. Reported priorities included SQL Server privilege escalation CVE-2026-21262 and Microsoft Authenticator information disclosure CVE-2026-26123.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
threataft.com
Open sourceegfincirt-wpn.azurewebsites.net
Open sourceegfincirt-wpn.azurewebsites.net
Open sourcethreathunter.ai
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has released fixes for multiple **critical Microsoft Office, Word, and Outlook Classic vulnerabilities** that can lead to remote code execution when a victim opens or previews a specially crafted file or email. The affected flaws include Office bugs **CVE-2025-49695**, **CVE-2025-49696**, **CVE-2025-49697**, **CVE-2025-49699**, **CVE-2025-49702**, Word bug **CVE-2025-49698**, and newer Outlook/Word rendering issues **CVE-2026-45456**, **CVE-2026-45458**, and **CVE-2026-47635**. Microsoft described the bugs as stemming from memory-safety issues such as **use-after-free**, **heap-based buffer overflow**, **type confusion**, and **out-of-bounds read**, with several carrying **CVSS 8.4** ratings. In multiple cases, Microsoft said the **Preview Pane** can trigger exploitation, and some flaws may be exploited without additional user interaction once malicious content is rendered. Microsoft said the vulnerable code paths affect Office and Word components, including the **Word rendering engine** used by **Outlook Classic**, and that supported builds such as **Microsoft Office LTSC 2024** and Mac Office LTSC channels received updates, with some Mac patches arriving later. Most of the 2025 flaws were not publicly disclosed or exploited at publication, though Microsoft assessed some as **more likely** to be exploited; the 2026 Outlook and Word issues similarly prompted urgent patching guidance because remotely delivered email content can trigger local processing and code execution. Microsoft urged organizations to install all applicable updates and strengthen defenses around Office email handling, including **Protected View**, **Attack Surface Reduction** rules, and monitoring for suspicious Office child-process activity.
Jun 29, 2026
Microsoft disclosed and patched several remote code execution vulnerabilities affecting **Microsoft Office**, **Word**, and **Outlook**, including `CVE-2025-49698`, `CVE-2025-49702`, `CVE-2025-54906`, `CVE-2025-62554`, `CVE-2025-62557`, `CVE-2025-62558`, and `CVE-2025-62562`. The advisories identify repeated RCE issues across core productivity applications, with separate entries for Office-wide flaws as well as product-specific weaknesses in Word and Outlook. The cluster of disclosures indicates a sustained stream of code-execution bugs in Microsoft’s document and messaging ecosystem, raising the risk of compromise through malicious files or email content handled by widely deployed enterprise software. Organizations using Microsoft 365 and on-premises Office components should prioritize the relevant security updates and verify patch coverage for Office, Word, and Outlook installations across user endpoints.
Jul 12, 2026
Microsoft disclosed and fixed two critical use-after-free vulnerabilities affecting **Microsoft Office** and **Microsoft Word**: `CVE-2026-40358` and `CVE-2026-40366`. Both bugs are classified as **CWE-416** and carry a **CVSS 8.4** rating, with Microsoft assessing impacts to confidentiality, integrity, and availability as high. The company said neither flaw had been publicly disclosed or exploited in the wild at the time of publication, and it rated exploitation as less likely. Microsoft said the vulnerabilities can lead to remote code execution, although the attack vector is described as **local**, with the **Preview Pane** able to serve as an attack path when malicious content is handled. The disclosures continue a broader pattern of Microsoft patching multiple remote code execution issues across its product line, including earlier Office flaws such as `CVE-2024-30101`, `CVE-2025-24080`, and `CVE-2025-59234`, as well as RCE bugs in Windows Connected Devices Platform Service, Remote Desktop Protocol, and Inbox COM Objects.
Jun 29, 2026