Cyber Resilience

CVE-2026-40360

High

Published: 12 May 2026

Published
12 May 2026
Modified
19 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0006 19.5th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-40360 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 19.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CWE(s)
CWE-125

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

Out-of-bounds read enables local memory/info disclosure from the system.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-26109Same product: Microsoft 365 Apps
CVE-2025-21383Same product: Microsoft 365 Apps
CVE-2026-20946Same product: Microsoft 365 Apps
CVE-2026-21259Same product: Microsoft 365 Apps
CVE-2025-21381Same product: Microsoft 365 Apps
CVE-2026-40362Same product: Microsoft 365 Apps
CVE-2025-24082Same product: Microsoft 365 Apps
CVE-2026-20950Same product: Microsoft 365 Apps
CVE-2025-21387Same product: Microsoft 365 Apps
CVE-2025-21394Same product: Microsoft 365 Apps

Affected Assets

microsoft
365 apps
all versions
microsoft
excel
2016
microsoft
office
2019
microsoft
office long term servicing channel
2021, 2024
microsoft
office online server
≤ 16.0.10417.20128

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References