Microsoft’s June 2026 Patch Tuesday release tackles CVE-2026-45457, a remote code execution vulnerability in the parsing engine of Microsoft Word. Published on June 9, the advisory carries a high confidence metric—a signal from the Microsoft Security Response Center that the flaw is real and that credible technical details exist. That makes this more than another routine Office update: for home users, IT admins, and anyone who handles documents daily, the clock starts now.

What’s in the advisory—and what’s not

The MSRC entry for CVE-2026-45457 is concise. It describes a vulnerability in Microsoft Word that could allow an attacker to run arbitrary code if they can convince a victim to open a specially crafted file—or, in some configurations, simply preview it. The attack vector is the document itself, arriving via email, a shared link, a cloud storage sync, or any other channel that delivers a .docx, .rtf, or older-format file. Microsoft’s usual phrasing notes that exploitation “could” require user interaction, but in a world where finance teams process invoices, HR reviews résumés, and executives open board materials, “user interaction” is not a barrier—it is the job.

The advisory’s standout detail is the confidence metric. Microsoft explains that this score reflects “the degree of confidence in the existence of the vulnerability and the credibility of the known technical details.” Here, that confidence is high: the vendor has acknowledged the bug, researchers have corroborated its existence, and enough technical detail is available to guide attackers who know how to reverse-engineer a patch. Defenders should treat this as a confirmed, weaponizable RCE that will become increasingly attractive once the update provides a diff for attackers to study.

No public proof-of-concept or active exploitation is mentioned in the advisory, but that is cold comfort. Word vulnerabilities tend to follow a predictable rhythm: patch ships, exploit interest spikes, and any organization still running unpatched Office in the weeks that follow becomes low-hanging fruit for commodity phishing campaigns.

Why a Word RCE still matters in 2026

Windows security has evolved dramatically over the past decade. Kernel hardening, browser sandboxing, endpoint detection, and cloud identity protections have raised the bar. Yet the humble document parser remains an outsized risk because it sits at the intersection of trust and productivity. Word is not simply a text editor; it is a compatibility layer for decades of file-format history, a host for embedded objects, scripts, and legacy features that must all safely interpret untrusted input. Every compatibility promise made by the Office team increases the code surface that can be reached by a malformed file.

Remote code execution in Word means an attacker can turn a document from inert content into a command-and-control beachhead. The exploit chain might start with a lure document tailored to a specific department, or it might be blasted broadly through spam systems. Even if the initial payload is a simple loader, the consequences can escalate quickly: credential theft, lateral movement, ransomware staging. Because Word documents are the lingua franca of business communication, the distribution channel is already built in.

Who is affected: scanning the damage radius

The vulnerability affects supported versions of Microsoft Office, including Microsoft 365 Apps, Office LTSC, Office 2019, and Office 2021. Different installations receive patches through different channels—Click-to-Run, Windows Update, or standalone packages from the Microsoft Update Catalog. The patch is not delivered via the Windows cumulative update; it is a separate Office update that reaches each endpoint based on its update channel configuration. If your organization defers Office updates or runs a perpetual version that is no longer supported (such as Office 2016 or earlier), you are exposed.

Automated systems that process Word documents—email gateways, document management platforms, preview generators, antivirus sandboxes—are also in the blast radius. Any component that loads the Word parser silently, without a user ever double-clicking a file, can trigger the vulnerability if it handles a malicious document. This widens the sense of urgency beyond desktop endpoints.

How we arrived here: the document parser’s dilemma

Word’s file-parsing complexity is both a competitive asset and a permanent security liability. Over three decades, Microsoft has added features, backward compatibility, and cross-format conversion while maintaining the promise that every document ever created can still be read. That legacy comes at a cost. Attackers can fuzz the parser with malformed structures and often find a way to corrupt memory or hijack the execution flow.

CVE-2026-45457 is the latest in a long line of Office RCEs that span the full history of Patch Tuesday. In many cases, the root cause lives deep in the code that handles embedded elements, font tables, or graphic objects—areas that are rarely touched by users but are always reachable by attackers. Microsoft has layered on mitigations: Protected View, file-block policies, macro restrictions, and Attack Surface Reduction rules. But these are seatbelts, not a redesign of the engine. A new vulnerability in the parser itself can bypass many of them, especially if it does not rely on macros or active content that a user must enable.

The advisory’s confidence metric underscores how the vulnerability lifecycle has matured. Rather than downplaying the risk, Microsoft is signaling that this bug deserves attention even without a flashy name. For administrators, the timeline is straightforward: the patch releases June 9, and the window for safe deployment starts immediately.

What to do now: a triage checklist

For Windows home users

  1. Open Word, click File > Account > Update Options > Update Now. If you see a “You’re up to date” message, verify the build number against the security advisory. Close and restart Office apps afterward—a downloaded patch doesn’t become active until the running application process is replaced.
  2. Enable automatic updates for Microsoft 365 Apps if you haven’t already. In the same Account menu, under “Product Information,” ensure updates are set to happen automatically. Delaying updates for more than a week after Patch Tuesday is a high-stakes gamble with document-handling software.
  3. Treat unexpected documents with caution, even if they look legitimate. Urgent requests for you to review an invoice, a legal notice, or a shipment document are textbook phishing lures. If the sender is unfamiliar, do not open, preview, or forward the file without verification.
  4. If you run an older, unsupported version of Office (Office 2016 or prior, or a standalone copy that no longer receives updates), the risk is not theoretical. Upgrade to a supported version or stop using that machine to open documents from untrusted sources. Unpatched Office is a welcome mat for document-borne malware.

For IT administrators and security teams

  1. Run a scan of your Office versions immediately. Identify every endpoint and server that has Word installed—including golden images, remote desktop hosts, and shared workstations. The patch is available through typical update channels (Current Channel, Monthly Enterprise Channel, Semi-Annual Enterprise Channel) and via the Microsoft Update Catalog for perpetual versions.
  2. Confirm patch deployment, not just approval. Many organizations approve updates through WSUS, ConfigMgr, or Intune but do not verify that the updated .exe and .dll files are loaded into running processes. After the patch is pushed, force-restart Office applications or schedule a reboot. Check event logs or use management tools to compare build numbers with the advisory’s listed versions.
  3. Revisit your Office hardening policies. Attack surface reduction rules should block Office applications from creating child processes, launching executable content from email and webmail, and running suspicious macros. Enable Protected View for all files that originate from the internet, and configure file-block settings to stop users from opening older, high-risk formats like legacy .doc or .rtf if business workflows allow.
  4. Segment document processing pipelines. If you have systems that automatically parse Word files—email filters, e-discovery tools, fax-to-email gateways—ensure those systems are patched and isolated. Treat them as high-value targets because they process untrusted content at scale.
  5. Create a contingency plan for unpatched systems. If a business-critical line-of-business app cannot be updated for weeks, tighten the environment around it. Strip macros from all inbound documents, enforce two-factor authentication for that user group, monitor Word process creation for abnormal child processes, and limit that system’s network access.

Outlook: the document attack surface isn’t going anywhere

CVE-2026-45457 will not be the last Word RCE. Microsoft’s ongoing investment in Office repair merits recognition, but the fundamental challenge remains: a complex parser that must handle centuries’ worth of file-format quirks while operating as the default reader for billions of users. The real defense lies less in any single patch and more in how quickly organizations can close the gap between an advisory and full deployment.

The coming weeks will tell the usual story. Researchers will diff the patch and publish root-cause analyses. Exploit brokers will adapt. Commodity phishing kits will add new attachment tricks. But the organizations that already know their Office estate, that verify updates instead of assuming them, and that treat document security as a frontline concern rather than an afterthought will ride this wave without incident. For everyone else, CVE-2026-45457 is the June reminder that patching Office is just as critical as patching the OS—and that the most dangerous links in the chain are often the ones we trust the most.