CVE-2026-40364

—1

CVSS 3.1

8.4 high

EPSS

4%p91

Published

May 12, 2026 (May 12, 2026)

Modified

Jun 17, 2026

Description

Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Vendors: microsoft
Products: 365 apps, office, office long term servicing channel, word
Weakness: CWE-122, CWE-843, CWE-908
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (4.4%)

In the news5 stories

Microsoft Patches 138 Vulnerabilities, Including DNS and Netlogon RCE Flaws

The Hacker NewsMay 15, 00:00 UTC · May 15, 2026Vulnerability in the wildCVE-2025-54518 CVE-2026-41096 CVE-2026-42826+14 CVEs1

60

Microsoft Patch Tuesday for May 2026 fix 138 bugs, some of them are alarming

Security AffairsMay 13, 19:28 UTC · May 13, 2026Vulnerability in the wildCVE-2026-42898 CVE-2026-41089 CVE-2026-41096+4 CVEs

60

Microsoft Patch Tuesday for May 2026 — Snort rules and prominent vulnerabilities

Cisco TalosMay 13, 15:34 UTC · May 13, 2026Vulnerability in the wildCVE-2026-32161 CVE-2026-33109 CVE-2026-33844+22 CVEs

60

Microsoft’s agentic security system found four critical Windows RCE flaws

Help Net SecurityMay 13, 00:00 UTC · May 13, 2026Vulnerability CVE-2026-40361 CVE-2026-403641

60

Microsoft May 2026 Patch Tuesday: Many fixes, but no zero-days

Help Net SecurityMay 12, 00:00 UTC · May 12, 2026Vulnerability in the wildCVE-2026-40361 CVE-2026-40364 CVE-2026-41089+2 CVEs

60