Cyber Resilience

CVE-2026-40364

High

Published: 12 May 2026

Published
12 May 2026
Modified
19 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0442 90.2th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-40364 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 8.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 9.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CWE(s)
CWE-122CWE-843CWE-908

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
attack.mitre.org →
Why these techniques?

Type confusion in Word directly enables client-side code execution via malicious file (T1203, T1204.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-21356Same product: Microsoft 365 Apps
CVE-2025-24079Same product: Microsoft 365 Apps
CVE-2025-24057Same product: Microsoft 365 Apps
CVE-2026-20948Same product: Microsoft 365 Apps
CVE-2026-40367Same product: Microsoft 365 Apps
CVE-2025-21186Same product: Microsoft 365 Apps
CVE-2025-21395Same product: Microsoft 365 Apps
CVE-2025-21392Same product: Microsoft 365 Apps
CVE-2025-21345Same product: Microsoft 365 Apps
CVE-2026-40361Same product: Microsoft 365 Apps

Affected Assets

microsoft
365 apps
all versions
microsoft
office
2019
microsoft
office long term servicing channel
2021, 2024
microsoft
word
2016

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References