CVE-2026-40364: Microsoft Word RCE Vulnerability

CVE-2026-40364 Overview

CVE-2026-40364 is a type confusion vulnerability in Microsoft Office Word that allows an unauthorized attacker to execute code locally. The flaw arises when Word accesses a resource using an incompatible type, leading to memory corruption that an attacker can leverage to run arbitrary code in the context of the current user. The issue is tracked under CWE-122 (heap-based memory corruption) and carries a CVSS 3.1 base score of 8.4. Microsoft published guidance through the Microsoft Security Update Guide.

Critical Impact

Successful exploitation grants code execution with the privileges of the user opening the crafted Word document, with high impact to confidentiality, integrity, and availability.

Affected Products

• Microsoft Office Word (specific versions per Microsoft Security Update Guide)
• Microsoft Office product family components that share the Word rendering engine
• Endpoints processing untrusted .doc, .docx, or .rtf files

Discovery Timeline

• 2026-05-12 - CVE-2026-40364 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-40364

Vulnerability Analysis

The vulnerability is a type confusion condition in Microsoft Office Word. Word parses complex document structures containing embedded objects, fields, and OLE streams. When the parser interprets an object header inconsistently with the underlying data layout, it operates on memory as a different type than the one originally allocated.

This mismatch produces incorrect pointer dereferences and corrupts the heap. The CWE-122 classification indicates the corruption occurs on the heap, where attacker-controlled data can overlap with object metadata, function pointers, or virtual table references. The result is reliable hijack of control flow within the Word process.

The attack vector is local and requires no privileges or user interaction beyond opening the malicious document, which makes weaponized files delivered via email, file shares, or download links a practical delivery method.

Root Cause

The root cause is improper type validation when Word resolves a resource referenced inside a document. The code path treats the resource as one type while the underlying allocation matches a different, incompatible type. Heap memory accessed under the wrong type assumption produces deterministic corruption suitable for exploitation.

Attack Vector

An attacker crafts a malicious Office document that triggers the type confusion when opened. Because the CVSS vector reports no user interaction beyond the normal document open and no required privileges, the document executes its payload as soon as Word parses the malicious structure. Code runs in the user context, providing a foothold for credential theft, lateral movement, or persistence.

No public proof-of-concept code is available at this time. Technical details are described in the Microsoft Security Update Guide.

Detection Methods for CVE-2026-40364

Indicators of Compromise

• Microsoft Word (winword.exe) spawning child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe
• Unexpected outbound network connections initiated from winword.exe shortly after document open
• Office documents with anomalous embedded objects, oversized OLE streams, or malformed structured storage
• New executable files or scripts written to %TEMP%, %APPDATA%, or user profile directories by Word

Detection Strategies

• Hunt for parent-child process relationships where winword.exe launches interpreters or system binaries
• Inspect Office documents with static analysis tools to flag malformed object headers consistent with type confusion triggers
• Correlate document open events with subsequent process and file creation activity on the same host
• Enable Microsoft Office telemetry and Antimalware Scan Interface (AMSI) logging for macro and object activity

Monitoring Recommendations

• Forward Sysmon process creation, image load, and network connection events for Office processes to a central SIEM
• Alert on winword.exe loading non-standard DLLs or making outbound connections to uncategorized destinations
• Track Office crash telemetry, since exploitation attempts frequently produce access violations before stabilizing

How to Mitigate CVE-2026-40364

Immediate Actions Required

• Apply the security update published by Microsoft for the affected Office Word versions as referenced in the Microsoft Security Update Guide
• Enforce Protected View and Office Application Guard for documents originating from email, the internet, or untrusted file shares
• Block inbound Office document attachments from external senders at the email gateway until patches are deployed
• Restrict child process creation from Office applications using Microsoft Defender Attack Surface Reduction (ASR) rules

Patch Information

Microsoft addresses CVE-2026-40364 through its monthly security update channel. Administrators should consult the Microsoft Security Update Guide for the specific build numbers, KB identifiers, and Click-to-Run channel updates that resolve the type confusion in Word. Deploy through Windows Update, WSUS, Microsoft Intune, or the Microsoft 365 Apps admin center based on environment topology.

Workarounds

• Open untrusted documents only inside Protected View and disable the option to exit Protected View for files from the internet
• Enable the ASR rule Block all Office applications from creating child processes (GUID D4F940AB-401B-4EFC-AAA1-ACDD1F65EBD8)
• Configure File Block policy in Office Trust Center to prevent legacy binary formats (.doc, .rtf) from opening or to force them into Protected View
• Remove local administrator rights from end users to limit the impact of code execution under the user context

# Enable the ASR rule to block Office child process creation via PowerShell
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AAA1-ACDD1F65EBD8 -AttackSurfaceReductionRules_Actions Enabled

# Verify the rule is enabled
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids