CVE-2026-40363
High
Published: 12 May 2026
Published
12 May 2026
Modified
22 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1
8.4
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.0038
30.2th percentile
Summary
CVE-2026-40363 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 30.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-29645
Vulnerability details
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?
Heap buffer overflow in Office client app directly enables arbitrary code execution via malicious document (T1203).
Confidence: HIGH · MITRE ATT&CK Enterprise v19.0
CVEs Like This One
CVE-2025-49697Same product: Microsoft 365 Apps
CVE-2026-42831Same product: Microsoft 365 Copilot
CVE-2026-26110Same product: Microsoft 365 Apps
CVE-2025-62557Same product: Microsoft 365 Apps
CVE-2025-49695Same product: Microsoft 365 Apps
CVE-2025-24057Same product: Microsoft 365 Apps
CVE-2025-62554Same product: Microsoft 365 Apps
CVE-2025-21186Same product: Microsoft 365 Apps
CVE-2025-21395Same product: Microsoft 365 Apps
CVE-2026-40358Same product: Microsoft 365 Apps
Affected Assets
microsoft
365 apps
all versions
microsoft
365 copilot
≤ 16.0.19822.20190
microsoft
office
2016, 2019
microsoft
office long term servicing channel
2021, 2024
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.