NewA calmer, faster ZeroHour — security assessments on articles, story timelines and search from any page.

Vulnerability3 · 1 read

CVE-2026-40364

CVSS 3.1: 8.4 high
EPSS: 4%p91
Published: May 12, 2026 · May 12, 2026
Modified: Oct 26, 2026

Analyze CVE-2026-40364 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Vendors: microsoft

Products: 365 apps, office, office long term servicing channel, word

Weakness: CWE-122, CWE-843, CWE-908

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (4.4%)

In the news

5 stories

Microsoft Patches 138 Vulnerabilities, Including DNS and Netlogon RCE Flaws

The Hacker NewsMay 15, 00:00 UTC · May 15, 2026VulnerabilityExploitedCVE-2025-54518 CVE-2026-41096 CVE-2026-42826+142

60

Microsoft Patch Tuesday for May 2026 fix 138 bugs, some of them are alarming

Security AffairsMay 13, 19:28 UTC · May 13, 2026VulnerabilityExploitedCVE-2026-42898 CVE-2026-41089 CVE-2026-41096+42 · 1 read

60

Microsoft Patch Tuesday for May 2026 — Snort rules and prominent vulnerabilities

Cisco TalosMay 13, 15:34 UTC · May 13, 2026VulnerabilityExploitedCVE-2026-32161 CVE-2026-33109 CVE-2026-33844+224 · 1 read

60

Microsoft’s agentic security system found four critical Windows RCE flaws

Help Net SecurityMay 13, 00:00 UTC · May 13, 2026VulnerabilityCVE-2026-40361 CVE-2026-403643 · 1 read

60

Microsoft May 2026 Patch Tuesday: Many fixes, but no zero-days

Help Net SecurityMay 12, 00:00 UTC · May 12, 2026VulnerabilityExploitedCVE-2026-40361 CVE-2026-40364 CVE-2026-41089+24 · 1 read

60