Patch Now: Critical Zero-Click Microsoft Outlook RCE (CVE-2026-45456)

The cyber threat landscape is continuously evolving, and Microsoft’s June 2026 Patch Tuesday update stands as a stark reminder of the complexities involved in securing modern enterprise environments.

Among the 206 security updates released a massive patch bundle addressing three distinct zero-days one specific vulnerability has captured the attention of threat hunters and system administrators alike: CVE-2026-45456.

Categorized as a Critical severity flaw with a CVSS 3.1 base score of 8.4, CVE-2026-45456 represents a highly dangerous Remote Code Execution (RCE) vulnerability stemming from a Type Confusion error (CWE-843) within Microsoft Office’s core architecture.

Crucially, the vulnerability exposes both Microsoft Outlook and Microsoft Word, leveraging the underlying text rendering engine to achieve arbitrary code execution.

This comprehensive technical analysis unpacks the mechanics of CVE-2026-45456, breaking down its exploitation vectors, architectural implications, and the necessary mitigation strategies organizations must adopt to secure their perimeters.

At its core, CVE-2026-45456 is rooted in a Type Confusion (CWE-843) weakness. In software engineering, type confusion occurs when a program allocates or initializes a resource such as a pointer, an object, or a memory buffer using one specific data type, but subsequently accesses or manipulates that resource using an incompatible or entirely different type.

In languages like C and C++, which form the backbone of Microsoft Office’s legacy codebase, this memory corruption issue can be catastrophically leveraged by an attacker.

When the rendering engine expects an object of “Type A” but is fed a maliciously crafted object of “Type B”, it attempts to read memory offsets that do not align with the original object’s structure.

This misalignment often leads to out-of-bounds memory access, allowing the attacker to overwrite function pointers or control execution flow. Ultimately, this transforms a standard rendering task into arbitrary, local code execution.

The most alarming aspect of CVE-2026-45456 is its primary attack vector: Microsoft Outlook (classic). While the vulnerability technically resides within the Microsoft Word codebase, Outlook relies extensively on Word’s complex text rendering engine to parse and display rich HTML, RTF, and proprietary document formats contained within incoming emails.

Threat actors exploit this intertwined architecture by dispatching a specially crafted email containing the malicious payload. When Outlook receives the email and initiates the Word rendering components to display the content, the type confusion vulnerability is triggered.

Security teams must pay close attention to a critical detail confirmed by Microsoft: The Outlook Preview Pane is a viable attack vector for this vulnerability.

Because the Preview Pane automatically processes and renders email content upon selection, exploitation requires no user interaction (UI:N).

The victim does not need to open a malicious attachment or click a malicious hyperlink; simply highlighting the email or allowing Outlook to automatically render the message in the background is sufficient to trigger the arbitrary code execution.

This zero-click nature dramatically elevates the threat level, as it bypasses traditional security awareness training that warns users against interacting with suspicious elements.

A common source of confusion surrounding CVE-2026-45456 is the apparent contradiction between its title—”Remote Code Execution” and its official CVSS 3.1 vector string, which lists the Attack Vector as Local (AV:L).

CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AV:L (Local): In the strict grammar of the Common Vulnerability Scoring System, the attack vector is designated as “Local” because the malicious code is not executed over a network protocol. Instead, the payload is delivered over the network (e.g., via email), but the exploitation itself happens locally on the victim’s CPU when the local application (Word/Outlook) processes the file content.
Remote Code Execution (Title): The term “Remote” in Microsoft’s advisory title refers to the geographical positioning of the attacker. The adversary is remote, dispatching the payload across the internet to compromise a local endpoint. This is also frequently referred to as Arbitrary Code Execution (ACE).

The vulnerability also features Low Attack Complexity (AC:L) and requires No Privileges (PR:N), granting an unauthenticated attacker the ability to completely compromise the Confidentiality, Integrity, and Availability of the victim’s host operating system.

The type confusion flaw impacts a broad spectrum of enterprise productivity software, underscoring the ubiquity of the vulnerable Word rendering engine. Organizations running the following software must prioritize patch deployment:

Microsoft Word 2016 (32-bit and 64-bit editions)
Microsoft Office LTSC 2021 and LTSC 2024 (32-bit and 64-bit editions)
Microsoft 365 Apps for Enterprise
Microsoft Office 2019
Microsoft SharePoint Server (2016 Enterprise, 2019, and Subscription Edition)

It is important to note that while the vulnerability affects Microsoft Office LTSC for Mac (2021 and 2024) and Microsoft 365 for Mac, security updates for the macOS ecosystem were not immediately available at the time of the initial CVE publication.

System administrators managing macOS fleets must remain vigilant and apply the forthcoming patches the moment Microsoft makes them available.

Mitigation

The discovery of CVE-2026-45456 during the historic June 2026 Patch Tuesday which also addressed vulnerabilities like the HTTP/2 DoS flaw (CVE-2026-49160) and the BitLocker bypass (CVE-2026-50507) demands an aggressive patch management strategy.

Organizations must immediately deploy the necessary Knowledge Base (KB) updates to all affected endpoints. Microsoft advises that if multiple updates apply to a system, they can be installed in any order.

For environments where immediate patching is unfeasible, administrators should consider temporary mitigations, such as entirely disabling the Outlook Preview Pane via Group Policy Objects (GPO).

While this reduces user convenience, it effectively neuters the zero-click attack vector until security updates can be successfully verified and deployed.

As threat actors increasingly target memory allocation flaws in trusted, ubiquitous applications, maintaining a rigorous patch cadence remains the most effective defense against sophisticated code execution attacks.