Cyber Resilience

CVE-2026-40366

HighUpdated

Published: 12 May 2026

Published
12 May 2026
Modified
01 June 2026
KEV Added
Patch
CVSS Score v3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0038 30.2th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-40366 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 8.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 30.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Use-after-free in client application (Word) directly enables arbitrary code execution via malicious document.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-40361Same product: Microsoft 365 Apps
CVE-2026-40358Same product: Microsoft 365 Apps
CVE-2026-20952Same product: Microsoft 365 Apps
CVE-2025-53731Same product: Microsoft 365 Apps
CVE-2025-53740Same product: Microsoft 365 Apps
CVE-2025-24079Same product: Microsoft 365 Apps
CVE-2025-24080Same product: Microsoft 365 Apps
CVE-2025-62557Same product: Microsoft 365 Apps
CVE-2025-49695Same product: Microsoft 365 Apps
CVE-2026-20953Same product: Microsoft 365 Apps

Affected Assets

microsoft
365 apps
all versions
microsoft
office
2019
microsoft
office long term servicing channel
2021, 2024
microsoft
word
2016

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-416

Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.

References