Remote Code Execution Type Confusion in Microsoft Office via Outlook Classic/Word Rendering

CVE-2026-45456 is a critical type confusion vulnerability in Microsoft Office, specifically in the Office document parsing and Word rendering pipeline used by Microsoft Word and by Outlook Classic for rendering email content. The flaw arises from access of a resource using an incompatible type, allowing attacker-controlled content to be interpreted as a valid object or pointer during document or message rendering. A specially crafted Office document, email body, or attachment can trigger memory corruption when processed by the vulnerable Word rendering functionality. Because Outlook Classic uses Word as its rendering engine, exploitation may occur when malicious content is rendered in the Preview Pane, without the user explicitly opening an attachment. Successful exploitation can result in arbitrary code execution in the context of the current user.