HarborGuard / CVE
Back to search
HIGHCVE-2026-40367Published Modified CNA microsoft

CVE-2026-40367: Microsoft Word Remote Code Execution Vulnerability

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Metrics

CVSS v3.1
8.4
Severity
HIGH
Fixed in
16.0.5552.1000
Affected Products
10

Fix available

16.0.5552.100016.0.5552.100216.0.10417.2012816.0.19725.2028016.109.26051019https://aka.ms/OfficeSecurityReleases
Patch commits
Affected packages
  • Microsoft / Microsoft 365 Apps for Enterprise
    < https://aka.ms/OfficeSecurityReleases (from 16.0.1)
  • Microsoft / Microsoft Office 2019
    < https://aka.ms/OfficeSecurityReleases (from 19.0.0)
  • Microsoft / Microsoft Office LTSC 2021
    < https://aka.ms/OfficeSecurityReleases (from 16.0.1)
  • Microsoft / Microsoft Office LTSC 2024
    < https://aka.ms/OfficeSecurityReleases (from 16.0.0)
  • Microsoft / Microsoft Office LTSC for Mac 2021
    < 16.109.26051019 (from 16.0.1)
  • Microsoft / Microsoft Office LTSC for Mac 2024
    < 16.109.26051019 (from 16.0.0)
  • Microsoft / Microsoft SharePoint Enterprise Server 2016
    < 16.0.5552.1002 (from 16.0.0)
  • Microsoft / Microsoft SharePoint Server 2019
    < 16.0.10417.20128 (from 16.0.0)
  • Microsoft / Microsoft SharePoint Server Subscription Edition
    < 16.0.19725.20280 (from 16.0.0)
  • Microsoft / Microsoft Word 2016
    < 16.0.5552.1000 (from 16.0.1)
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
References