PT-2026-40202 · Microsoft · Office Word+1

Published 2026-05-12 · Updated 2026-06-04 · CVE-2026-40367

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Office Word (affected versions not specified)

Description An untrusted pointer dereference allows an unauthorized attacker to execute arbitrary code locally and remotely, affecting the system. A pointer dereference occurs when a program attempts to read or write data at a memory address stored in a pointer that has not been properly validated.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Untrusted Pointer Dereference

Weakness Enumeration

CWE-822

Related Identifiers

BDU:2026-06856

CVE-2026-40367

Affected Products

Office Word

Sharepoint Server

References · 9

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40367 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/732329 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-40367 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40367 · Security Note
• https://bdu.fstec.ru/vul/2026-06856 · Security Note
• https://t.me/cveNotify/164240 · Telegram Post
• https://twitter.com/f1tym1/status/2057092677288493542 · Twitter Post
• https://twitter.com/integ_sec/status/2062527716767736310 · Twitter Post
• https://t.me/cveNotify/164318 · Telegram Post