Microsoft Office CVE-2026-40363

Exploitation requires the victim to process an attacker-crafted Office file on a vulnerable build (e.g., Office 2016 below 16.0.5552.1000, Office for Android below 16.0.19822.20190, or Office LTSC for Mac 2021/2024 below 16.109.26051019); the malformed document must reach and be opened/previewed in the affected application. The supplied CVSS vector states UI:N and PR:N (no interaction, unauthenticated), but for an Office document-parsing heap overflow this conflicts with the AV:L 'execute code locally' description, which implies the victim must open the file - treat user interaction as a likely limiting factor pending MSRC confirmation. Limiting factors: local attack vector (AV:L) means no remote/network-only trigger, exploitation is not automatable (SSVC Automatable: no), code runs only with the invoking user's privileges (S:U), and Protected View or ASR rules further constrain execution.

Signals point to a serious-severity but low-urgency issue. The provided CVSS 3.1 base score is 8.4 with total technical impact (C:H/I:H/A:H), yet the exploitation signals are weak: EPSS is 0.04% (14th percentile), CISA SSVC rates Exploitation as none and Automatable as no, and no POC or KEV listing exists, so this is not currently a widely exploited threat. There is a notable inconsistency in the supplied CVSS vector: it lists AV:L with UI:N and PR:N, but a heap overflow in Office that 'allows an unauthorized attacker to execute code locally' almost always requires the victim to open or preview a crafted document - i.e., user interaction (UI:R). Verify the user-interaction requirement with Microsoft's MSRC advisory, because if UI:R applies the realistic risk is lower than the raw score implies. Overall this is a patch-on-normal-cadence item for most environments, though Office's enormous install base means it warrants timely rollout.

An attacker emails or hosts a specially crafted Office document containing a malformed record that triggers the heap overflow when the file is opened or previewed on a vulnerable Office build, executing code with the victim user's privileges. No public exploit code has been identified, and successful exploitation typically requires the target to open the malicious file, so social engineering (phishing) is the likely delivery method. With total technical impact, a single opened document can hand the attacker full control of the user's Office session and local data.