CVE-2026-40361: Microsoft Word Use-After-Free Vulnerability

CVE-2026-40361 Overview

CVE-2026-40361 is a use-after-free vulnerability in Microsoft Office Word that allows an unauthorized attacker to execute code locally. The flaw is tracked under CWE-416 and affects how Word manages object lifetimes in memory. An attacker can craft a malicious document that triggers reuse of freed memory, leading to arbitrary code execution in the context of the current user. The vulnerability requires local interaction with the affected application but no privileges or user interaction beyond opening the crafted file. Microsoft published guidance through the Microsoft Security Update CVE-2026-40361 advisory.

Critical Impact

Successful exploitation grants attackers code execution with the privileges of the user running Microsoft Word, enabling installation of programs, data theft, and creation of new accounts.

Affected Products

• Microsoft Office Word (refer to Microsoft Security Response Center advisory for affected builds)
• Microsoft 365 Apps installations that include Word
• Office deployments listed in the official MSRC advisory

Discovery Timeline

• 2026-05-12 - CVE-2026-40361 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-40361

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in Microsoft Office Word. Word references a memory object after it has been freed, allowing an attacker to control the contents of that memory region. By preparing the heap before the dangling reference is dereferenced, an attacker can redirect execution flow into attacker-controlled code. The attack vector is local, meaning the target user must open a crafted Word document or process attacker-supplied content through Word. Exploitation yields high impact across confidentiality, integrity, and availability because the resulting code execution runs in the context of the current user.

Root Cause

The root cause is improper object lifetime management within Word's document parsing or rendering logic. A code path frees an internal object but retains a pointer that is later dereferenced. When the freed memory is reallocated and populated with attacker-controlled data, the stale pointer references that controlled content. This condition is characteristic of complex file format parsers that maintain many interdependent object references during document processing.

Attack Vector

An attacker delivers a malicious .docx, .doc, or .rtf file through email, web download, file share, or removable media. When the target opens the document in Microsoft Word, the parsing logic triggers the use-after-free condition. No elevated privileges are required, and the exploit executes within the user's session. Code execution can then be used to drop additional payloads, harvest credentials, or pivot deeper into the environment. See the Microsoft Security Update CVE-2026-40361 advisory for vendor technical details.

No verified public proof-of-concept code is available at the time of writing.

Detection Methods for CVE-2026-40361

Indicators of Compromise

• Unexpected child processes spawned by WINWORD.EXE such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
• Word process crashes or abnormal terminations correlated with opening external documents.
• Outbound network connections originating from WINWORD.EXE to unfamiliar domains or IP addresses shortly after document open events.
• Creation of executable files, scripts, or scheduled tasks by the Office process tree.

Detection Strategies

• Hunt for process lineage anomalies where WINWORD.EXE is the parent of script interpreters or living-off-the-land binaries.
• Inspect Office telemetry for documents originating from the internet zone or Mark-of-the-Web tagged files that trigger macros or embedded objects.
• Apply YARA and content rules to flag malformed Office documents containing unusual OLE streams, ActiveX controls, or heap-spray patterns.

Monitoring Recommendations

• Forward Sysmon and EDR telemetry from endpoints running Microsoft Office to a central analytics platform for behavioral analysis.
• Alert on memory protection violations and exception events in WINWORD.EXE recorded by Windows Error Reporting.
• Monitor mail gateways and web proxies for inbound Office documents from untrusted senders and external sources.

How to Mitigate CVE-2026-40361

Immediate Actions Required

• Apply the security update referenced in the Microsoft Security Update CVE-2026-40361 advisory to all systems running affected Word builds.
• Prioritize patching for users who routinely process external documents such as finance, HR, legal, and executive staff.
• Validate that Microsoft Update or your enterprise patch management tool has pushed the update to all endpoints.

Patch Information

Microsoft has issued a security update for this vulnerability. Refer to the Microsoft Security Update CVE-2026-40361 advisory for the specific KB numbers, supported channels, and affected build ranges. Apply the update through Windows Update, Microsoft 365 Apps update channels, or your enterprise software distribution platform.

Workarounds

• Enforce Protected View for documents originating from the internet and email attachments to isolate parsing in a restricted process.
• Block or restrict legacy Office file formats at the mail gateway and require conversion to safer formats where possible.
• Disable or restrict ActiveX controls, OLE object embedding, and macros through Group Policy until patching is complete.
• Apply Attack Surface Reduction rules that block Office applications from creating child processes and from injecting code into other processes.

# Configuration example: enable ASR rule blocking Office child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled