CVE-2026-40366 - Microsoft Word Remote Code Execution Vulnerability · CoreCVE

Back Back to CVE browser

HIGH

Microsoft Word Remote Code Execution Vulnerability

Published May 12, 2026

8.4

HIGH

CVSS 3.1

EPSS 0.36%

Description

Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Affected products

Vendor Microsoft Product Microsoft 365 Apps for Enterprise Default
n/a
- Version
  16.0.1
  Status
  affected
  Constraints
  <https://aka.ms/OfficeSecurityReleases
Vendor Microsoft Product Microsoft Office 2019 Default
n/a
- Version
  19.0.0
  Status
  affected
  Constraints
  <https://aka.ms/OfficeSecurityReleases
Vendor Microsoft Product Microsoft Office LTSC 2021 Default
n/a
- Version
  16.0.1
  Status
  affected
  Constraints
  <https://aka.ms/OfficeSecurityReleases
Vendor Microsoft Product Microsoft Office LTSC 2024 Default
n/a
- Version
  16.0.0
  Status
  affected
  Constraints
  <https://aka.ms/OfficeSecurityReleases
Vendor Microsoft Product Microsoft Office LTSC for Mac 2021 Default
n/a
- Version
  16.0.1
  Status
  affected
  Constraints
  <16.109.26051019
Vendor Microsoft Product Microsoft Office LTSC for Mac 2024 Default
n/a
- Version
  16.0.0
  Status
  affected
  Constraints
  <16.109.26051019
Vendor Microsoft Product Microsoft Word 2016 Default
n/a
- Version
  16.0.1
  Status
  affected
  Constraints
  <16.0.5552.1000

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft 365 Apps for Enterprise

n/a

Version	Status	Constraints
16.0.1	affected	<https://aka.ms/OfficeSecurityReleases

Microsoft Office 2019

n/a

Version	Status	Constraints
19.0.0	affected	<https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC 2021

n/a

Version	Status	Constraints
16.0.1	affected	<https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC 2024

n/a

Version	Status	Constraints
16.0.0	affected	<https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC for Mac 2021

n/a

Version	Status	Constraints
16.0.1	affected	<16.109.26051019

Microsoft Office LTSC for Mac 2024

n/a

Version	Status	Constraints
16.0.0	affected	<16.109.26051019

Microsoft Word 2016

n/a

Version	Status	Constraints
16.0.1	affected	<16.0.5552.1000

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-416

Use After Free

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40366
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40366		vendor-advisorypatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published May 12, 2026

Updated Aug 10, 2026

Reserved Apr 11, 2026

Link CVE-2026-40366

CISA Vulnrichment

Updated May 13, 2026

Status Modified

Modified Jun 17, 2026

Link CVE-2026-40366

Severity n/a

Public date n/a

Links CVE-2026-40366