Attackers Can Exploit Microsoft Outlook and Word Flaws to Run Malicious Code

Gbhackers •Divya • June 12, 2026

Microsoft has disclosed a set of critical remote code execution (RCE) vulnerabilities affecting Outlook and Word that could allow attackers to execute arbitrary code on targeted systems. The flaws, tracked as CVE-2026-45456, CVE-2026-45458, and CVE-2026-47635, were released on June 9, 2026, and carry high severity ratings with CVSS scores of 8.4. Security researchers warn that […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerabilities Found in Microsoft Outlook and Word Microsoft has disclosed three critical remote code execution (RCE) vulnerabilities in Outlook and Word, identified as CVE-2026-45456, CVE-2026-45458, and CVE-2026-47635. These vulnerabilities, published on June 9, 2026, are linked to low-level memory safety issues in the Word rendering engine and its integration with Outlook Classic. Attackers could exploit these flaws to execute arbitrary code on targeted systems, affecting users of both applications. The vulnerabilities have a CVSS v3.1 base score of 8.4, indicating a high severity level. Microsoft has released patches to address these vulnerabilities, and users are urged to update their software immediately to mitigate potential risks. Security researchers are monitoring the situation for any signs of active exploitation. 2 sources 72

Extracted Entities

Attackers Can Exploit Microsoft Outlook and Word Flaws to Run Malicious Code

The full story

Extracted Entities

Companies (2)

CVEs (3)

Platforms (1)