CVE-2026-40358: Microsoft Office Use After Free Flaw

CVE-2026-40358 Overview

CVE-2026-40358 is a use-after-free vulnerability [CWE-416] in Microsoft Office that enables local code execution. An unauthorized attacker can exploit improper memory handling to execute arbitrary code in the context of the current user. The vulnerability requires no privileges and no user interaction once the malicious content is processed.

Microsoft published the advisory on May 12, 2026, and updated it on May 13, 2026. The flaw carries a high severity rating with confidentiality, integrity, and availability impacts. Successful exploitation grants attackers the same permissions as the victim user, which can lead to data theft, persistence, or lateral movement within enterprise environments.

Critical Impact

Local code execution in Microsoft Office allows attackers to run arbitrary code with the privileges of the logged-on user, enabling document-based attack chains against enterprise endpoints.

Affected Products

• Microsoft Office (version details available in the Microsoft Security Update Guide)
• Refer to the vendor advisory for the complete list of affected Office builds and channels
• Both perpetual and Click-to-Run distributions may be impacted pending Microsoft confirmation

Discovery Timeline

• 2026-05-12 - CVE-2026-40358 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-40358

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] within Microsoft Office. Use-after-free flaws occur when an application continues to reference memory after it has been freed. An attacker who controls the contents of the reallocated memory region can hijack program flow and execute arbitrary code.

In the context of Microsoft Office, this class of bug is typically reached through crafted document content that triggers object lifecycle mismanagement. When the application dereferences a dangling pointer, attacker-controlled data is interpreted as a valid object, leading to code execution under the user's security context.

The attack vector is local, meaning the attacker must deliver a malicious file to the target system. Common delivery methods for Office-based exploits include phishing emails with attachments and links to malicious documents on file shares.

Root Cause

The root cause is improper memory management within an Office component that fails to nullify or track pointers after the underlying object is released. Subsequent operations reuse the freed allocation, allowing attacker-supplied content to occupy the memory region. The application then operates on corrupted object state.

Attack Vector

Exploitation requires a victim to open or process a malicious Office document on a vulnerable system. The CVSS vector indicates no privileges and no user interaction are required at the exploitation stage, though delivery of the payload typically involves social engineering. Successful exploitation yields code execution in the current user context, which attackers can chain with privilege escalation primitives.

No verified public proof-of-concept code is currently available for CVE-2026-40358. Technical specifics should be obtained from the Microsoft Security Update Guide.

Detection Methods for CVE-2026-40358

Indicators of Compromise

• Unexpected child processes spawned by winword.exe, excel.exe, powerpnt.exe, or outlook.exe such as cmd.exe, powershell.exe, or rundll32.exe
• Office applications writing executable content to %TEMP%, %APPDATA%, or %PUBLIC% directories
• Outbound network connections initiated directly from Office processes to untrusted hosts
• Crash telemetry referencing access violations or heap corruption in Office binaries

Detection Strategies

• Monitor process lineage where Office applications launch script interpreters or LOLBins
• Inspect inbound email attachments and shared documents for anomalous embedded objects, OLE streams, or active content
• Correlate Office crash events from Windows Error Reporting with subsequent suspicious process activity on the same host

Monitoring Recommendations

• Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office from creating child processes and writing executable content
• Forward Sysmon process creation, image load, and file creation events to a centralized SIEM for behavioral analytics
• Track endpoints that have not yet received the Microsoft May 2026 security update to prioritize patch deployment

How to Mitigate CVE-2026-40358

Immediate Actions Required

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-40358 to all affected Office installations
• Prioritize patching for users who routinely handle external documents, including finance, HR, and executive staff
• Verify that Click-to-Run updates have completed by checking Office build numbers against the vendor-published fixed versions

Patch Information

Microsoft has issued a security update addressing CVE-2026-40358. Administrators should consult the Microsoft Security Update Guide for the specific KB numbers and Office build versions that remediate the vulnerability. Deploy updates through Microsoft Update, WSUS, Intune, or Configuration Manager.

Workarounds

• Enable Protected View and Office Application Guard to isolate documents originating from the internet or email
• Configure ASR rules to block Office child process creation and executable content creation from Office macros
• Disable or restrict legacy file formats and active content where they are not required for business operations
• Apply application allow-listing to prevent untrusted binaries from executing if exploitation succeeds

# Enable Microsoft Defender ASR rules to reduce Office exploitation risk
# Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Block Office applications from creating executable content
Set-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 -AttackSurfaceReductionRules_Actions Enabled

# Block Win32 API calls from Office macros
Set-MpPreference -AttackSurfaceReductionRules_Ids 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B -AttackSurfaceReductionRules_Actions Enabled