Microsoft Word CVE-2026-40361

Exploitation requires the attacker to get a crafted Microsoft Word document onto the target and have it opened/processed locally by a vulnerable Word build (Word 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps, or Office LTSC for Mac 2021/2024); code executes only in the context of the user opening the file. Limiting factors: the vector is local (AV:L), not network-remote, so delivery depends on email/download/social engineering; in practice a user must open the malicious document even though the published CVSS lists UI:N (this inconsistency should be verified with Microsoft); there is no privilege escalation implied (S:U), so the attacker gains only the victim's privileges; and there is no known active exploitation or public exploit code.

Signals are mixed and lean toward moderate real-world priority. CVSS is 8.4 (High) with total technical impact (C:H/I:H/A:H), but the vector is AV:L (local), meaning exploitation is not remotely network-reachable and typically requires the victim to open a crafted file. Notably, the CVSS vector lists UI:N (no user interaction) despite a local Word document-parsing bug that in practice would require a user to open a malicious document - this AV:L/UI:N combination is internally inconsistent and should be verified against the Microsoft advisory; the practical attack almost certainly involves user interaction. EPSS is very low (0.06%), CISA SSVC marks Exploitation as 'none' and Automatable 'no', and there is no KEV listing and no public exploit identified - so this is a real-but-not-urgent issue: patch on the normal Patch Tuesday cycle rather than as an emergency.

An attacker emails or otherwise delivers a specially crafted Word document to a target; when the victim opens it, the malformed structure triggers the use-after-free in Word's parser, letting the attacker's controlled data steer freed-memory reuse and execute code as the logged-in user. Given AV:L this is a file-delivery/social-engineering attack rather than a remote network exploit, and no public proof-of-concept has been identified at time of analysis.