Critical Microsoft Outlook, Word RCE Flaws Patched in June 2024 Updates

Key Takeaways

• Microsoft has addressed three critical remote code execution (RCE) vulnerabilities in Outlook and Word.
• These flaws, rated 8.4 CVSS, could allow attackers to execute arbitrary code without user interaction, merely by previewing or rendering a malicious email.
• The vulnerabilities are due to memory-safety issues within the Word rendering engine, which Outlook Classic utilizes.
• Patches were released in the June 2024 updates and are essential for all affected Microsoft Office installations.

Microsoft Addresses Critical RCE Flaws in Outlook and Word

Microsoft has deployed crucial security updates to rectify three closely related remote code execution (RCE) vulnerabilities impacting its widely used Outlook and Word applications. These significant flaws, stemming from underlying memory-safety issues within the Word rendering engine and its integration with Outlook Classic, present a substantial risk to users.

The vulnerabilities, identified as CVE‑2026‑45456, CVE‑2026‑45458, and CVE‑2026‑47635, each carry a Critical severity rating with a CVSS v3.1 base score of 8.4. This score underscores the high potential impact on confidentiality, integrity, and availability should these flaws be exploited.

Despite the CVSS vectors indicating a local attack vector (AV:L), Microsoft has categorized these as remote code execution vulnerabilities. This classification is due to the mechanism by which an attacker can deliver malicious content over a network, such as via email. The exploit then triggers locally when the Office application processes the malicious content, even without explicit user interaction like opening an attachment.

Deep Dive into the Vulnerabilities

All three vulnerabilities originate from insecure memory handling practices within the Office document parsing pipeline. Two of the flaws, CVE‑2026‑45456 and CVE‑2026‑47635, are specifically type confusion vulnerabilities. This occurs when internal data structures are accessed using an incompatible or incorrect data type, thereby compromising the system’s type safety guarantees during runtime.

In a practical exploitation scenario, a specially crafted document could manipulate assumptions about object layout within the Word engine. This manipulation would cause the engine to misinterpret attacker-controlled data as a legitimate object or pointer. When the engine subsequently performs operations on this incorrectly typed object, it can lead to controlled memory corruption, allowing attackers to hijack control flow mechanisms, such as function pointers or vtable entries, to execute arbitrary code.

The third vulnerability, CVE‑2026‑45458, is a use-after-free vulnerability. This pattern involves Word freeing a memory object but retaining a dangling pointer to its former location. An attacker could craft a document that causes this freed memory region to be reallocated with attacker-controlled data. When the stale pointer is later dereferenced, execution flows through the attacker’s data, again enabling arbitrary code execution.

Impact on Outlook and Exploitation Vector

A critical operational detail for defenders is that Outlook Classic leverages Word as its rendering engine for email content, including the Preview Pane. This means a maliciously crafted email body or attachment that triggers one of these memory corruption paths can execute code simply by being rendered in the Preview Pane, without requiring the user to explicitly open an attachment.

From an attacker’s perspective, this significantly simplifies the kill chain. A remote attacker could send a single weaponized email to a target, rely on automatic rendering or user preview in Outlook, and achieve arbitrary code execution with the victim user’s permissions. Because these vulnerabilities do not demand additional privileges or explicit user interaction beyond normal rendering, a successful exploit could be chained with privilege escalation or lateral movement techniques to deepen an attacker’s foothold within an environment.

Affected Products and Remediation

The scope of affected products includes Microsoft Office LTSC 2024 (both 32-bit and 64-bit versions) and other supported builds of Word and Outlook that utilize the same rendering components. Microsoft’s guidance emphasizes that customers must apply all relevant Office security updates across all their installations, particularly in environments with multiple Office SKUs, ensuring each product line receives its corresponding security package.

While most patches are available, some Mac Office channels, such as Office LTSC for Mac 2021/2024 and Microsoft 365 for Mac, may receive their updates slightly later. However, these are part of the same comprehensive remediation effort. Patching remains the primary and indispensable mitigation strategy, as these are core engine-level issues that cannot be fully neutralized through configuration changes alone.

What You Should Do

• Apply Patches Immediately: Ensure all Microsoft Office installations, especially Outlook and Word, are updated with the latest June 2024 security patches. Prioritize systems that handle external email.
• Enable Protected View: Enforce Protected View for all files originating from the internet to add an extra layer of security against malicious documents.
• Consider Disabling Preview Pane: For untrusted mailboxes or in high-security environments, consider disabling or limiting the Outlook Preview Pane to prevent automatic rendering of potentially malicious email content.
• Implement Attack Surface Reduction (ASR) Rules: Utilize ASR rules to restrict Office applications from spawning child processes, which can significantly hinder post-exploitation activities.
• Monitor for Anomalous Behavior: Security teams should actively monitor for unusual memory access violations, application crashes related to message rendering, or suspicious child processes originating from Word or Outlook, as these could indicate exploit attempts.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.