CVE-2026-45456High
MSR
MSR
Microsoft Security Response Center
The Security Update Guide is the source of truth for vulnerabilities in Microsoft products — KB article numbers, impacted builds and replacement patches. MSRC also assigns the MSRC-specific exploitability index used alongside CVSS.
Region
US
Updates
Patch Tuesday + ad-hoc
License
Proprietary
Microsoft's Security Update Guide, covering Windows, Office, Azure, SQL Server, Exchange and other first-party products.
https://msrc.microsoft.com/update-guide →Share link
Anyone with the link can open this vulnerability.
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS
8.4
High
EPSS
0.00
p39
Published
2026-01-01
Updated
2026-01-01
Description
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
Tags · CWE
CWE-843
CWE-843BaseIncomplete
Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
https://cwe.mitre.org/data/definitions/843.html →Open in CWE collection →Affected products
365_appsMicrosoft_365Office_2016Office_2019Office_2021Office_2024Sharepoint_server < 16.0.19725.20384Sharepoint_server
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
2026-01-01
Published
2026-01-01
Updated
CVSS 3.1 breakdown
Attack Vector
AV: L
Local (L)
Attack Complexity
AC: L
Low (L)
Privileges Required
PR: N
None (N)
User Interaction
UI: N
None (N)
Scope
S: U
Unchanged (U)
Confidentiality Impact
C: H
High (H)
Integrity Impact
I: H
High (H)
Availability Impact
A: H
High (H)
Exploit indicators
EPSS
0.002 · p39
Known exploited (KEV)
No
Known exploits — Сканер-ВС
No Сканер-ВС checks registered for this vulnerability yet.
Affected software
| Product | Vendor | Status |
|---|---|---|
| 365_apps | * | Tracked |
| microsoft_365 | * | Tracked |
| office_2016 | * | Tracked |
| office_2019 | * | Tracked |
| office_2021 | * | Tracked |
| office_2024 | * | Tracked |
| sharepoint_server | * | Tracked |
| Windows | Microsoft | Tracked |
| Windows | Microsoft | Tracked |
| Windows | Microsoft | Tracked |
| Windows | Microsoft | Tracked |
| Windows | Microsoft | Tracked |
| Windows | Microsoft | Tracked |
Source databases
MSR
MSR
Microsoft Security Response Center
The Security Update Guide is the source of truth for vulnerabilities in Microsoft products — KB article numbers, impacted builds and replacement patches. MSRC also assigns the MSRC-specific exploitability index used alongside CVSS.
Region
US
Updates
Patch Tuesday + ad-hoc
License
Proprietary
Microsoft's Security Update Guide, covering Windows, Office, Azure, SQL Server, Exchange and other first-party products.
https://msrc.microsoft.com/update-guide →CVE
CVE
National Vulnerability Database
NVD is the U.S. government repository of standards-based vulnerability management data, built on top of the MITRE CVE list. Every record includes CPE applicability statements, CVSS v2 and v3.x base scores, CWE mappings and cross-references to advisories.
Region
US
Updates
15 min
License
Public Domain
Comprehensive catalog of publicly disclosed vulnerabilities with CPE matches, CVSS scoring and reference URLs. De-facto standard for cross-vendor correlation.
https://nvd.nist.gov →Related vulnerabilities
External references