| CVE Number | Vulnerability | Product | Severity | Date |
|---|---|---|---|---|
| CVE-2026-40367 | Microsoft Word Remote Code Execution Vulnerability | Microsoft Office, Microsoft 365, Microsoft Word, Microsoft SharePoint | Critical | 29-05-2026 |
Technical Information
An unauthorized attacker could exploit an untrusted pointer dereference vulnerability in Microsoft Office Word to execute arbitrary code locally by convincing a user to open a specially crafted Word document.
Patch release date: May 12, 2026
Further information on this vulnerability is available at : CVE-2026-40367
Affected Software
Microsoft SharePoint Enterprise Server 2016,Microsoft SharePoint Server 2019,
Microsoft Office 2019 for 32-bit editions,
Microsoft Office 2019 for 64-bit editions,
Microsoft 365 Apps for Enterprise for 32-bit Systems,
Microsoft 365 Apps for Enterprise for 64-bit Systems,
Microsoft Office LTSC for Mac 2021,
Microsoft Office LTSC 2021 for 64-bit editions,
Microsoft Office LTSC 2021 for 32-bit editions,
Microsoft SharePoint Server Subscription Edition,
Microsoft Office LTSC 2024 for 32-bit editions,
Microsoft Office LTSC 2024 for 64-bit editions,
Microsoft Office LTSC for Mac 2024,
Microsoft Word 2016 (32-bit edition),
Microsoft Word 2016 (64-bit edition)