Microsoft Word CVE-2026-40367

Exploitation requires the victim's Office/Word instance to open or process an attacker-crafted document that carries the malformed pointer data - the trigger is document parsing, not a network service. The affected products are the specific Office builds listed (Word 2016, 365 Apps, Office 2019, Office LTSC 2021/2024, Office for Mac 2021/2024) and SharePoint servers that render documents. Limiting factors: exploitation is local (AV:L) and, despite the input vector's UI:N, realistically depends on user interaction (a user opening the malicious file) or a server-side document-processing pipeline in the SharePoint case; SSVC marks it not automatable, so it is unsuitable for wormable mass exploitation and lends itself to targeted social-engineering delivery. Only unpatched builds below the fixed versions are vulnerable.

The signals point to a serious-but-not-urgent issue. The CVSS 8.4 and SSVC 'total' technical impact reflect full code execution, but SSVC exploitation is 'none', SSVC automatable is 'no', and EPSS is only 0.04% (14th percentile), so widespread automated exploitation is unlikely near-term. There is a notable internal conflict in the provided CVSS vector: it lists AV:L with UI:N, yet an untrusted-pointer-dereference in Word realistically requires a victim to open a malicious document, which normally implies UI:R - verify with Microsoft's advisory, as the true prerequisite is almost certainly user interaction. The provided PR:N should be read cautiously for the same reason. Additionally, the 'Authentication Bypass' tag appears inconsistent with a memory-corruption RCE and is likely a mislabel. Net: prioritize patching because impact is total and Office is enormously widespread, but there is no evidence of active exploitation.

An attacker emails or shares a specially crafted Word document; when a user in an affected Office version opens it, the malformed structure triggers the untrusted pointer dereference and runs the attacker's code with that user's privileges. Given AC:L (low complexity) and total technical impact, a single successful open could yield full endpoint compromise, though no public proof-of-concept is currently identified.