CVE-2026-40361

—

CVSS 3.1

8.4 high

EPSS

<1%p47

Published

May 12, 2026 (May 12, 2026)

Modified

Jun 17, 2026

Description

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

Vendors: microsoft
Products: 365 apps, office, office long term servicing channel, word
Weakness: CWE-416
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news5 stories

Microsoft Patches 138 Vulnerabilities, Including DNS and Netlogon RCE Flaws

The Hacker NewsMay 15, 00:00 UTC · May 15, 2026Vulnerability in the wildCVE-2025-54518 CVE-2026-41096 CVE-2026-42826+14 CVEs1

60

Microsoft Patch Tuesday for May 2026 fix 138 bugs, some of them are alarming

Security AffairsMay 13, 19:28 UTC · May 13, 2026Vulnerability in the wildCVE-2026-42898 CVE-2026-41089 CVE-2026-41096+4 CVEs

60

Microsoft Patch Tuesday for May 2026 — Snort rules and prominent vulnerabilities

Cisco TalosMay 13, 15:34 UTC · May 13, 2026Vulnerability in the wildCVE-2026-32161 CVE-2026-33109 CVE-2026-33844+22 CVEs

60

Microsoft’s agentic security system found four critical Windows RCE flaws

Help Net SecurityMay 13, 00:00 UTC · May 13, 2026Vulnerability CVE-2026-40361 CVE-2026-403641

60

Microsoft May 2026 Patch Tuesday: Many fixes, but no zero-days

Help Net SecurityMay 12, 00:00 UTC · May 12, 2026Vulnerability in the wildCVE-2026-40361 CVE-2026-40364 CVE-2026-41089+2 CVEs

60