Microsoft Word Remote Code Execution Vulnerability
Priority LOW 39CWE-822Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Microsoft. Impact type from Microsoft.
Summary
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00453 39th percentileScored 2026-11-07
Fix Fixed Microsoft: 6 updates
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise | 16.0.1 to before https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases | Patch available | CNA |
| Microsoft | Microsoft Office 2019 | 19.0.0 to before https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases | Patch available | CNA |
| Microsoft | Microsoft Office LTSC 2021 | 16.0.1 to before https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases | Patch available | CNA |
| Microsoft | Microsoft Office LTSC 2024 | 16.0.0 to before https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases | Patch available | CNA |
| Microsoft | Microsoft Office LTSC for Mac 2021 | 16.0.1 to before 16.109.26051019 | 16.109.26051019 | Patch available | CNA |
| Microsoft | Microsoft Office LTSC for Mac 2024 | 16.0.0 to before 16.109.26051019 | 16.109.26051019 | Patch available | CNA |
| Microsoft | Microsoft SharePoint Enterprise Server 2016 | 16.0.0 to before 16.0.5552.1002 | 16.0.5552.1002 | Patch available | CNA |
| Microsoft | Microsoft SharePoint Server 2019 | 16.0.0 to before 16.0.10417.20128 | 16.0.10417.20128 | Patch available | CNA |
| Microsoft | Microsoft SharePoint Server Subscription Edition | 16.0.0 to before 16.0.19725.20280 | 16.0.19725.20280 | Patch available | CNA |
| Microsoft | Microsoft Word 2016 | 16.0.1 to before 16.0.5552.1000 | 16.0.5552.1000 | Patch available | CNA |
- Microsoft 365 Apps for Enterprise VendorMicrosoft Affected 16.0.1 to before https://aka.ms/OfficeSecurityReleases Fixed in https://aka.ms/OfficeSecurityReleases Patch available CNA
- Microsoft Office 2019 VendorMicrosoft Affected 19.0.0 to before https://aka.ms/OfficeSecurityReleases Fixed in https://aka.ms/OfficeSecurityReleases Patch available CNA
- Microsoft Office LTSC 2021 VendorMicrosoft Affected 16.0.1 to before https://aka.ms/OfficeSecurityReleases Fixed in https://aka.ms/OfficeSecurityReleases Patch available CNA
- Microsoft Office LTSC 2024 VendorMicrosoft Affected 16.0.0 to before https://aka.ms/OfficeSecurityReleases Fixed in https://aka.ms/OfficeSecurityReleases Patch available CNA
- Microsoft Office LTSC for Mac 2021 VendorMicrosoft Affected 16.0.1 to before 16.109.26051019 Fixed in 16.109.26051019 Patch available CNA
- Microsoft Office LTSC for Mac 2024 VendorMicrosoft Affected 16.0.0 to before 16.109.26051019 Fixed in 16.109.26051019 Patch available CNA
- Microsoft SharePoint Enterprise Server 2016 VendorMicrosoft Affected 16.0.0 to before 16.0.5552.1002 Fixed in 16.0.5552.1002 Patch available CNA
- Microsoft SharePoint Server 2019 VendorMicrosoft Affected 16.0.0 to before 16.0.10417.20128 Fixed in 16.0.10417.20128 Patch available CNA
- Microsoft SharePoint Server Subscription Edition VendorMicrosoft Affected 16.0.0 to before 16.0.19725.20280 Fixed in 16.0.19725.20280 Patch available CNA
- Microsoft Word 2016 VendorMicrosoft Affected 16.0.1 to before 16.0.5552.1000 Fixed in 16.0.5552.1000 Patch available CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:* | 2019 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x86:* | 2019 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:* | 2021 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x86:* | 2021 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:* | 2021 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x64:* | 2024 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x86:* | 2024 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:macos:*:* | 2024 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:* Versions 2019 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x86:* Versions 2019 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:* Versions 2021 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x86:* Versions 2021 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:* Versions 2021 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x64:* Versions 2024 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x86:* Versions 2024 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:macos:*:* Versions 2024 Vulnerable ·Microsoft
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:* | before 16.0.19725.20280 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:* | 2016 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* | 2019 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:x64:* | 2016 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:x86:* | 2016 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:* Versions before 16.0.19725.20280 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:* Versions 2016 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:x64:* Versions 2016 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:x86:* Versions 2016 Vulnerable ·Microsoft
Remediation
Microsoft 6 updates
- Security Update
- Microsoft SharePoint Server 2019 16.0.10417.20128
- Security Update
- Microsoft SharePoint Server 2019 16.0.10417.20128
- Security Update
- Microsoft SharePoint Enterprise Server 2016 16.0.5552.1002
Show 3 more Microsoft updates
- Security Update
- Microsoft SharePoint Enterprise Server 2016 16.0.5552.1002
- Security Update
- Microsoft SharePoint Server Subscription Edition 16.0.19725.20280
- Security Update
- Microsoft Word 2016 (32-bit edition) 16.0.5552.1000
- Microsoft Word 2016 (64-bit edition) 16.0.5552.1000
Vendor assessments
Microsoft
Microsoft's page for this CVE →
- Impact
- Remote Code Execution
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Unlikely
| Product | Status | Plan or fix |
|---|---|---|
| Microsoft 365 Apps for Enterprise for 32-bit Systems | Fixed | https · //aka.ms/OfficeSecurityReleases |
| Microsoft 365 Apps for Enterprise for 64-bit Systems | Fixed | https · //aka.ms/OfficeSecurityReleases |
| Microsoft Office 2019 for 32-bit editions | Fixed | https · //aka.ms/OfficeSecurityReleases |
| Microsoft Office 2019 for 64-bit editions | Fixed | https · //aka.ms/OfficeSecurityReleases |
| Microsoft Office LTSC 2021 for 32-bit editions | Fixed | https · //aka.ms/OfficeSecurityReleases |
| Microsoft Office LTSC 2021 for 64-bit editions | Fixed | https · //aka.ms/OfficeSecurityReleases |
| Microsoft Office LTSC 2024 for 32-bit editions | Fixed | https · //aka.ms/OfficeSecurityReleases |
| Microsoft Office LTSC 2024 for 64-bit editions | Fixed | https · //aka.ms/OfficeSecurityReleases |
| Microsoft Office LTSC for Mac 2021 | Fixed | 16.109.26051019 · Security Update |
| Microsoft Office LTSC for Mac 2024 | Fixed | 16.109.26051019 · Security Update |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-40367
- 2026-10-03 Alias added: GHSA-hv6m-qg7h-hqf7
References
More Microsoft 365 Apps vulnerabilities
- TI-2024-14173 Microsoft Outlook Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2023-09240 Microsoft Outlook Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2024-25471 Microsoft Project Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 8.8
- TI-2023-17652 Microsoft Outlook Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 8.8
- TI-2026-17368 Microsoft Word Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 7.8
- TI-2026-17363 Microsoft Office Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 7.8
Sources
- CVE-2026-40367 · CVE Program
- CVE-2026-40367 · NVD
- FIRST EPSS
- GHSA-hv6m-qg7h-hqf7 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-40367 · Microsoft Security Update Guide
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences