EUVD-2026-29649
GHSA-hv6m-qg7h-hqf7
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local file-parsing RCE realistically needs the victim to open a crafted document (UI:R), no prior auth (PR:N), low complexity, with total C/I/A impact in the user's context.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Articles & Coverage 1
AnalysisAI
Local code execution in Microsoft Word (and Office 2016/2019, LTSC 2021/2024, 365 Apps, Office for Mac, and SharePoint Server) stems from an untrusted pointer dereference (CWE-822) that lets an attacker run arbitrary code with the victim's privileges when a malicious file is processed. Microsoft rates it CVSS 8.4 with total technical impact (high confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC marks exploitation as none and not automatable, indicating no observed real-world attacks yet.
Technical ContextAI
The root cause is CWE-822, Untrusted Pointer Dereference, where the Office/Word file parser trusts a pointer value derived from attacker-controlled document data and dereferences it without validation. When Word deserializes a crafted document, this corrupted pointer redirects execution or memory access to an attacker-influenced address, enabling arbitrary code execution in the context of the Office process. Per the CPE data the same code path is shared across the Office family - Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, Office LTSC for Mac 2021/2024, Word 2016 - and the Office rendering components embedded in SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, which is why SharePoint (server-side document handling) is also listed as affected.
RemediationAI
Apply the Microsoft security update for CVE-2026-40367 (Vendor-released patch: available from Microsoft) using the exact fixed builds from the advisory - Word 2016 16.0.5552.1000, SharePoint Enterprise Server 2016 16.0.5552.1002, SharePoint Server 2019 16.0.10417.20128, SharePoint Server Subscription Edition 16.0.19725.20280, and Office LTSC for Mac 2021/2024 16.109.26051019; for 365 Apps, Office 2019, and Office LTSC 2021/2024, take the current channel update via https://aka.ms/OfficeSecurityReleases and the guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40367. Until patched, reduce exposure by opening untrusted documents in Protected View / Application Guard (which sandboxes the parser but breaks editing and some macros), blocking or quarantining Office documents from external email and web sources at the gateway (adds friction to legitimate mail), and restricting who can upload/process documents on affected SharePoint servers (limits collaboration workflows). These are compensating controls only and do not remove the flaw.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-822 – Untrusted Pointer Dereference
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today