CVE-2026-40367: Microsoft Office Word RCE Vulnerability

CVE-2026-40367 Overview

CVE-2026-40367 is an untrusted pointer dereference vulnerability in Microsoft Office Word that allows an unauthorized attacker to execute code locally. The flaw is categorized under [CWE-822] (Untrusted Pointer Dereference), where Word follows a pointer value originating from attacker-controlled input. Successful exploitation results in arbitrary code execution in the context of the current user. Microsoft published the advisory on May 12, 2026, and assigned a CVSS v3.1 base score of 8.4.

Critical Impact

An attacker can achieve local code execution with no privileges and no user interaction required at the time of trigger, fully compromising the confidentiality, integrity, and availability of the affected host.

Affected Products

• Microsoft Office Word (see Microsoft Security Response Center advisory for affected build ranges)
• Microsoft 365 Apps deployments that include Word
• Standalone Office installations bundling the vulnerable Word component

Discovery Timeline

• 2026-05-12 - CVE-2026-40367 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-40367

Vulnerability Analysis

The vulnerability resides in Microsoft Office Word's parsing of document content. Word dereferences a pointer whose value originates from data inside a crafted document. Because the pointer is not validated against trusted memory regions, the application reads or writes to attacker-influenced addresses. This primitive can be shaped into arbitrary code execution within the Word process. The attack vector is local, requiring the target to open or preview a malicious document. The vulnerability affects the confidentiality, integrity, and availability of the system at the privilege level of the user running Word.

Root Cause

The root cause is an untrusted pointer dereference, classified as [CWE-822]. Word treats a value derived from document data as a valid pointer without verifying that the address lies within an expected, trusted memory range. When the parser follows that pointer during structured document handling, the resulting memory access lets an attacker steer execution flow or corrupt object state used later for control transfer.

Attack Vector

Exploitation begins with delivery of a malicious Word document through email, file share, removable media, or web download. When the victim opens the document, Word parses the embedded structure and dereferences the attacker-supplied pointer. The document can be crafted so that the dereference results in execution of attacker-chosen code within Word. No authentication is required, and no separate user interaction beyond opening the file is needed. The Microsoft Security Response Center advisory provides authoritative technical context. See the Microsoft Security Update CVE-2026-40367 for vendor details.

No public proof-of-concept code is currently available. The vulnerability mechanism is described here in prose because no verified exploit samples have been released.

Detection Methods for CVE-2026-40367

Indicators of Compromise

• Unexpected child processes spawned by winword.exe, such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
• Word writing executable content (.exe, .dll, .js, .hta) to user-writable directories like %TEMP%, %APPDATA%, or %PUBLIC%.
• Outbound network connections initiated directly by winword.exe to previously unseen domains or IP addresses.
• Crash events for winword.exe in the Windows Application event log shortly after opening a document from an external source.

Detection Strategies

• Hunt for process lineage anomalies where winword.exe is the parent of scripting or LOLBin processes.
• Correlate document open events from email or browser download paths with subsequent process creation and module loads in Word.
• Inspect Office telemetry for documents that disable Protected View or trigger structured parser exceptions.
• Apply YARA or static rules to inbound .doc, .docx, and .rtf files for malformed structures associated with pointer manipulation.

Monitoring Recommendations

• Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and from creating executable content.
• Forward Sysmon process creation, image load, and file create events from Office endpoints to a centralized SIEM for correlation.
• Monitor Mark-of-the-Web propagation on downloaded documents and alert when Protected View is bypassed.

How to Mitigate CVE-2026-40367

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-40367 advisory to all systems running Microsoft Office Word.
• Prioritize patching for users who routinely process external documents, such as finance, HR, legal, and executive staff.
• Enforce Protected View and Office Application Guard for documents originating from the internet or email.
• Block inbound Office documents from untrusted external senders at the email gateway pending patch rollout.

Patch Information

Microsoft has released a security update through its standard update channels. Administrators should consult the Microsoft Security Response Center entry for CVE-2026-40367 to identify the specific build numbers for each supported Office and Microsoft 365 Apps channel, and validate deployment with Microsoft Endpoint Configuration Manager, Intune, or Windows Update for Business.

Workarounds

• Configure Office to open documents from the internet in Protected View and disallow editing without explicit user approval.
• Disable preview handlers for Word documents in Windows Explorer and Outlook to prevent automatic parsing of untrusted files.
• Apply Attack Surface Reduction rules that block child process creation and executable content creation by Office applications.
• Restrict execution of macros and ActiveX controls in documents received from outside the organization.

# Configuration example: enable ASR rules to harden Office against document-based exploitation
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A,`
  3B576869-A4EC-4529-8536-B80A7769E899,`
  75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
  -AttackSurfaceReductionRules_Actions Enabled,Enabled,Enabled