PT-2026-40196 · Microsoft · Office Word+1

Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-40361

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Office Word (affected versions not specified) Microsoft Outlook (affected versions not specified)

Description A use after free issue in the shared library wwlib.dll allows an unauthorized attacker to execute code locally. In Microsoft Outlook, this can be triggered as a 0-click attack, meaning the issue is activated as soon as a victim reads or previews an email, without requiring the user to click links or attachments. This occurs because the flaw resides in the email rendering engine.

Recommendations As a temporary workaround for Microsoft Outlook, set the application to render emails only in plain text format. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-40361

Affected Products

Office Word

Outlook

References · 5

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40361 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40361 · Security Note
• https://twitter.com/ET_Labs/status/2054306093061611896 · Twitter Post
• https://twitter.com/HaifeiLi/status/2054268761528823931 · Twitter Post
• https://twitter.com/EditorsIntel/status/2054264847614046671 · Twitter Post