CVE-2026-45466 is a heap-based buffer overflow vulnerability in Microsoft Office Word component of Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker with local access to cause information disclosure. The vulnerability has been assigned a CVSS 3.1 score of 3.3 (low severity) with attack vector local, low attack complexity, no privileges required, and user interaction required. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are reported in the wild.

The vulnerability can lead to local information disclosure due to a heap-based buffer overflow in Microsoft Word. There is no indication of integrity or availability impact. The attack requires local access and user interaction, limiting the risk to low severity.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure that Microsoft 365 Apps for Enterprise is updated to the patched version as per the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45466.