Description
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Published: 2026-06-09
Score: 8.4 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

Affected Systems

The flaw affects Microsoft Office LTSC 2024, specifically Outlook and Word. The affected product variants include the long‑term servicing channel for both x86 and x64 builds.

Risk and Exploitability

The CVSS score of 8.4 indicates high severity, while the EPSS score of less than 1% reflects a low probability of exploitation in the near term. No KEV listing is present, suggesting no widespread exploitation has been reported. The vulnerability is a local code execution; the likely trigger is a specially crafted Office file that a user opens, either from a local source or via email attachment.

Generated by OpenCVE AI on August 2, 2026 at 01:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Microsoft update for CVE-2026-47635 published for Microsoft Office LTSC 2024 via the Microsoft Security Response Center update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47635).
  • Configure Office macro settings to ‘Disable all macros with notification’ or to allow only digitally signed macros to reduce the chance that malicious content exploits the overflow.
  • Deploy an up‑to‑date anti‑malware solution that automatically scans Office documents on open, and educate users to avoid opening attachments from untrusted or unknown sources.

Generated by OpenCVE AI on August 2, 2026 at 01:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 08 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
Description Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally. Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

Thu, 11 Jun 2026 18:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*
cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*

Wed, 10 Jun 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 09 Jun 2026 17:15:00 +0000

Type Values Removed Values Added
Description Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
Title Microsoft Outlook and Word Remote Code Execution Vulnerability
First Time appeared Microsoft
Microsoft office 2024
Weaknesses CWE-122
CPEs cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*
Vendors & Products Microsoft
Microsoft office 2024
References
Metrics cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Office 2024
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-07-28T22:18:56.040Z

Reserved: 2026-05-19T20:12:27.070Z

Link: CVE-2026-47635

cve-icon Vulnrichment

Updated: 2026-06-10T10:25:05.477Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-09T17:17:35.417

Modified: 2026-06-11T18:36:10.110

Link: CVE-2026-47635

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T02:00:13Z

Weaknesses
  • CWE-122

    Heap-based Buffer Overflow