EUVD-2026-29646
GHSA-mw8j-qvr9-2jpg
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local document-parsing flaw requiring a victim to open a crafted file, so AV:L and UI:R; no privileges needed (PR:N) and full type-confusion RCE yields C/I/A High.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Articles & Coverage 1
AnalysisAI
Local code execution in Microsoft Word (Office 2016 through Office LTSC 2024, Microsoft 365 Apps, and Office for Mac) results from a type-confusion flaw (CWE-843) that lets an unauthorized attacker run arbitrary code with the victim's privileges. Microsoft rates it CVSS 8.4 with total technical impact, but there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 35th percentile). CISA SSVC records exploitation status as none and the issue is not automatable, indicating no observed in-the-wild activity.
Technical ContextAI
The root cause is CWE-843, 'Access of Resource Using Incompatible Type' (type confusion), in Microsoft Word's document parsing engine. Type confusion occurs when code allocates or interprets a memory object as one type but later accesses it as an incompatible type, allowing an attacker to manipulate pointers, function tables, or object fields and coerce the parser into treating attacker-controlled data as trusted structures - a memory-corruption primitive that commonly leads to arbitrary code execution. The CPE data confirms the affected surface is the Word/Office application layer across Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, Word 2016, and Office LTSC for Mac 2021/2024, meaning the flawed parsing code is shared across both Windows and macOS Office builds.
RemediationAI
Apply the Microsoft security updates referenced in MSRC advisory CVE-2026-40364 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40364); patches are available from the vendor. For Word 2016 update to at least build 16.0.5552.1000, and for Office LTSC for Mac 2021/2024 update to at least 16.109.26051019; for Microsoft 365 Apps, Office 2019, and Office LTSC 2021/2024 install the current channel update via https://aka.ms/OfficeSecurityReleases as click-to-run/servicing typically auto-updates. Until patches are deployed, reduce exposure by opening untrusted documents only in Protected View / Application Guard and not disabling it, blocking or quarantining Word documents from external email and web sources at the gateway, and using Office 'Block macros/untrusted content' policies; note that enforcing Protected View and blocking inbound Office files can disrupt legitimate document workflows and should be scoped to untrusted sources.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today