RCE in Microsoft Outlook and Word via Word rendering engine

CVE-2026-45458 is a critical remote code execution vulnerability in Microsoft Office affecting Microsoft Outlook Classic and Microsoft Word. Although some descriptions label the issue as type confusion, the supporting content more specifically characterizes CVE-2026-45458 as a use-after-free flaw in the Office document parsing and Word rendering pipeline. The vulnerability arises when the Word engine dereferences a dangling pointer after previously freed memory is reallocated with attacker-controlled data, resulting in memory corruption. Because Outlook Classic uses the Word rendering engine to process email content, including Preview Pane rendering, a specially crafted email body or attachment can trigger the flaw when rendered by Outlook or opened in Word. Microsoft classifies the issue as allowing an unauthorized attacker to execute code locally, but the exploit chain can be initiated remotely through delivery of malicious content over email and then triggered locally when Office processes that content.