EUVD-2026-29649
GHSA-hv6m-qg7h-hqf7
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local file-parsing RCE realistically needs the victim to open a crafted document (UI:R), no prior auth (PR:N), low complexity, with total C/I/A impact in the user's context.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Articles & Coverage 1
AnalysisAI
Local code execution in Microsoft Word (and Office 2016/2019, LTSC 2021/2024, 365 Apps, Office for Mac, and SharePoint Server) stems from an untrusted pointer dereference (CWE-822) that lets an attacker run arbitrary code with the victim's privileges when a malicious file is processed. Microsoft rates it CVSS 8.4 with total technical impact (high confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC marks exploitation as none and not automatable, indicating no observed real-world attacks yet.
Technical ContextAI
The root cause is CWE-822, Untrusted Pointer Dereference, where the Office/Word file parser trusts a pointer value derived from attacker-controlled document data and dereferences it without validation. When Word deserializes a crafted document, this corrupted pointer redirects execution or memory access to an attacker-influenced address, enabling arbitrary code execution in the context of the Office process. Per the CPE data the same code path is shared across the Office family - Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, Office LTSC for Mac 2021/2024, Word 2016 - and the Office rendering components embedded in SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, which is why SharePoint (server-side document handling) is also listed as affected.
RemediationAI
Apply the Microsoft security update for CVE-2026-40367 (Vendor-released patch: available from Microsoft) using the exact fixed builds from the advisory - Word 2016 16.0.5552.1000, SharePoint Enterprise Server 2016 16.0.5552.1002, SharePoint Server 2019 16.0.10417.20128, SharePoint Server Subscription Edition 16.0.19725.20280, and Office LTSC for Mac 2021/2024 16.109.26051019; for 365 Apps, Office 2019, and Office LTSC 2021/2024, take the current channel update via https://aka.ms/OfficeSecurityReleases and the guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40367. Until patched, reduce exposure by opening untrusted documents in Protected View / Application Guard (which sandboxes the parser but breaks editing and some macros), blocking or quarantining Office documents from external email and web sources at the gateway (adds friction to legitimate mail), and restricting who can upload/process documents on affected SharePoint servers (limits collaboration workflows). These are compensating controls only and do not remove the flaw.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-822 – Untrusted Pointer Dereference
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today