Loading story…
Microsoft published security advisories for several Microsoft Word Remote Code Execution flaws, including CVE-2026-40364, CVE-2026-40367, and the earlier CVE-2026-33114, indicating multiple distinct code-execution issues affecting Word. The entries were released through the Microsoft Security Response Center's Security Update Guide and identify the vulnerabilities as capable of enabling remote code execution in the Office application.
The disclosures point to an ongoing stream of Word security fixes rather than a single isolated bug, underscoring continued risk around malicious document handling in enterprise environments. Organizations that rely on Microsoft Office should review the affected product listings and associated updates for each CVE in the Security Update Guide and prioritize patch deployment for systems where Word is installed or used to open untrusted files.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft published CVE-2026-40367 in its Security Update Guide as a Microsoft Word remote code execution vulnerability. The reference is dated 2026-05-12.
Microsoft published CVE-2026-40364 in its Security Update Guide as a Microsoft Word remote code execution vulnerability. The reference is dated 2026-05-12.
Microsoft added CVE-2026-33114, a Microsoft Word remote code execution vulnerability, to its Security Update Guide. The reference indicates the advisory was published on 2026-04-14.
4 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has disclosed multiple **Microsoft Word remote code execution** flaws in its Security Update Guide, including `CVE-2026-40366`, `CVE-2026-40361`, and the earlier-listed `CVE-2026-33115`. The advisories identify all three issues as Word RCE vulnerabilities, indicating that specially crafted Word documents or related content could allow arbitrary code execution in affected environments. The newly published entries for `CVE-2026-40366` and `CVE-2026-40361` expand a growing set of Word security issues alongside `CVE-2026-33115`, underscoring continued risk around document-based attack paths in Microsoft Office. Organizations using Microsoft Word should review the corresponding Security Update Guide entries, prioritize patch deployment, and reinforce controls for untrusted document handling while assessing exposure across user endpoints.
Jul 6, 2026
Microsoft disclosed and patched several remote code execution vulnerabilities affecting **Microsoft Office**, **Word**, and **Outlook**, including `CVE-2025-49698`, `CVE-2025-49702`, `CVE-2025-54906`, `CVE-2025-62554`, `CVE-2025-62557`, `CVE-2025-62558`, and `CVE-2025-62562`. The advisories identify repeated RCE issues across core productivity applications, with separate entries for Office-wide flaws as well as product-specific weaknesses in Word and Outlook. The cluster of disclosures indicates a sustained stream of code-execution bugs in Microsoft’s document and messaging ecosystem, raising the risk of compromise through malicious files or email content handled by widely deployed enterprise software. Organizations using Microsoft 365 and on-premises Office components should prioritize the relevant security updates and verify patch coverage for Office, Word, and Outlook installations across user endpoints.
Jul 6, 2026
Microsoft disclosed and fixed two critical use-after-free vulnerabilities affecting **Microsoft Office** and **Microsoft Word**: `CVE-2026-40358` and `CVE-2026-40366`. Both bugs are classified as **CWE-416** and carry a **CVSS 8.4** rating, with Microsoft assessing impacts to confidentiality, integrity, and availability as high. The company said neither flaw had been publicly disclosed or exploited in the wild at the time of publication, and it rated exploitation as less likely. Microsoft said the vulnerabilities can lead to remote code execution, although the attack vector is described as **local**, with the **Preview Pane** able to serve as an attack path when malicious content is handled. The disclosures continue a broader pattern of Microsoft patching multiple remote code execution issues across its product line, including earlier Office flaws such as `CVE-2024-30101`, `CVE-2025-24080`, and `CVE-2025-59234`, as well as RCE bugs in Windows Connected Devices Platform Service, Remote Desktop Protocol, and Inbox COM Objects.
Jun 29, 2026