Loading story…
Microsoft has disclosed multiple Microsoft Word remote code execution flaws in its Security Update Guide, including CVE-2026-40366, CVE-2026-40361, and the earlier-listed CVE-2026-33115. The advisories identify all three issues as Word RCE vulnerabilities, indicating that specially crafted Word documents or related content could allow arbitrary code execution in affected environments.
The newly published entries for CVE-2026-40366 and CVE-2026-40361 expand a growing set of Word security issues alongside CVE-2026-33115, underscoring continued risk around document-based attack paths in Microsoft Office. Organizations using Microsoft Word should review the corresponding Security Update Guide entries, prioritize patch deployment, and reinforce controls for untrusted document handling while assessing exposure across user endpoints.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft published a Security Update Guide entry for CVE-2026-40359, described as a Microsoft Excel Remote Code Execution Vulnerability. The reference indicates the advisory was published on 2026-05-12.
Microsoft published Security Update Guide entries for CVE-2026-40361 and CVE-2026-40366, both described as Microsoft Word Remote Code Execution Vulnerabilities. Both references show a publication date of 2026-05-12.
Microsoft added CVE-2026-33115 to its Security Update Guide as a Microsoft Word Remote Code Execution Vulnerability. The reference indicates the advisory was published on 2026-04-14.
6 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for several **Microsoft Word Remote Code Execution** flaws, including `CVE-2026-40364`, `CVE-2026-40367`, and the earlier `CVE-2026-33114`, indicating multiple distinct code-execution issues affecting Word. The entries were released through the Microsoft Security Response Center's Security Update Guide and identify the vulnerabilities as capable of enabling remote code execution in the Office application. The disclosures point to an ongoing stream of Word security fixes rather than a single isolated bug, underscoring continued risk around malicious document handling in enterprise environments. Organizations that rely on Microsoft Office should review the affected product listings and associated updates for each CVE in the Security Update Guide and prioritize patch deployment for systems where Word is installed or used to open untrusted files.
Jul 6, 2026
Microsoft disclosed and fixed two critical use-after-free vulnerabilities affecting **Microsoft Office** and **Microsoft Word**: `CVE-2026-40358` and `CVE-2026-40366`. Both bugs are classified as **CWE-416** and carry a **CVSS 8.4** rating, with Microsoft assessing impacts to confidentiality, integrity, and availability as high. The company said neither flaw had been publicly disclosed or exploited in the wild at the time of publication, and it rated exploitation as less likely. Microsoft said the vulnerabilities can lead to remote code execution, although the attack vector is described as **local**, with the **Preview Pane** able to serve as an attack path when malicious content is handled. The disclosures continue a broader pattern of Microsoft patching multiple remote code execution issues across its product line, including earlier Office flaws such as `CVE-2024-30101`, `CVE-2025-24080`, and `CVE-2025-59234`, as well as RCE bugs in Windows Connected Devices Platform Service, Remote Desktop Protocol, and Inbox COM Objects.
Jun 29, 2026
Microsoft disclosed and patched several remote code execution vulnerabilities affecting **Microsoft Office**, **Word**, and **Outlook**, including `CVE-2025-49698`, `CVE-2025-49702`, `CVE-2025-54906`, `CVE-2025-62554`, `CVE-2025-62557`, `CVE-2025-62558`, and `CVE-2025-62562`. The advisories identify repeated RCE issues across core productivity applications, with separate entries for Office-wide flaws as well as product-specific weaknesses in Word and Outlook. The cluster of disclosures indicates a sustained stream of code-execution bugs in Microsoft’s document and messaging ecosystem, raising the risk of compromise through malicious files or email content handled by widely deployed enterprise software. Organizations using Microsoft 365 and on-premises Office components should prioritize the relevant security updates and verify patch coverage for Office, Word, and Outlook installations across user endpoints.
Jul 6, 2026