Cyber Resilience

CVE-2026-45456

HighUpdated

Published: 09 June 2026

Published
09 June 2026
Modified
19 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0044 35.1th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-45456 is a high-severity Type Confusion (CWE-843) vulnerability in Microsoft Office 2021. Its CVSS base score is 8.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 35.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

CWE(s)
CWE-843

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
Why these techniques?

Type confusion vulnerability in Microsoft Office directly enables local code execution via client-side exploitation (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

microsoft
365 apps
all versions
microsoft
microsoft 365
all versions
microsoft
office 2016
all versions
microsoft
office 2019
all versions
microsoft
office 2021
all versions
microsoft
office 2024
all versions
microsoft
sharepoint server
2016, 2019 · ≤ 16.0.19725.20384

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References