Microsoft Word CVE-2026-40364

Exploitation requires the attacker to deliver a maliciously crafted Word document to a vulnerable Office/Word installation (Word 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps, or Office for Mac 2021/2024) and have it processed locally by the target - the attack surface is the local document-parsing path (AV:L), and code runs only in the context of the user who processes the file. Limiting factors: the vector is local rather than network-remote, exploitation yields only user-level privileges (no privilege escalation is described), and realistically the victim must open or preview the crafted document - note that although the CVSS vector states UI:N, a Word type-confusion RCE typically depends on the user opening the file, a discrepancy that should be verified against the MSRC advisory. No authentication bypass or special server configuration is documented as a prerequisite beyond a vulnerable, unpatched Office build.

The signals point to a serious-but-not-urgent priority. The CVSS 8.4 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and SSVC 'total' technical impact reflect that successful exploitation fully compromises confidentiality, integrity, and availability. However, several signals temper real-world risk: EPSS is only 0.15% (35th percentile), SSVC exploitation is 'none', Automatable is 'no', there is no KEV listing, and no public exploit is identified - so this is a high-severity issue without evidence of active or imminent mass exploitation. There is a notable inconsistency to verify: the CVSS vector states UI:N (no user interaction), yet a type-confusion RCE in Word is realistically triggered by a victim opening a crafted document, which normally implies UI:R - verify with the Microsoft advisory, as this affects how 'unauthenticated/no-interaction' the attack truly is. The 'Authentication Bypass' tag is also not reflected in the CWE (type confusion/memory corruption) or the description and should be treated as unconfirmed metadata.

An attacker emails or hosts a specially crafted Word document that triggers the type-confusion condition in Word's parser when processed; because the vector is local (AV:L) with no privileges required, the victim opening or previewing the file causes attacker-controlled memory corruption that executes code in the user's security context. No public exploit is identified at time of analysis, so this remains a plausible rather than demonstrated attack path.