Microsoft Word Untrusted Pointer Dereference Local Code Execution Vulnerability

Successful exploitation can result in arbitrary code execution in the security context of the targeted user on the local system. Based on the supplied context, exploitation may occur when a victim opens or previews a specially crafted Word document, enabling compromise of the endpoint and follow-on actions consistent with code execution, such as malware deployment, data access, or lateral movement subject to the victim's privileges.

Until patches are fully deployed, reduce exposure by warning users not to open unsolicited or suspicious Office/Word documents, including files received from apparently known contacts. Because the supplied content indicates these Office/Word RCE issues may be exploitable via the Preview Pane, organizations should treat document preview as a potential trigger path and apply compensating controls around email and document handling, alongside enhanced monitoring on endpoints, email systems, and file servers. Detection content such as the referenced Cisco Talos Snort rules may also help identify exploitation attempts.

Apply the Microsoft security updates released for May 2026 that address CVE-2026-40367 in Microsoft Word/Office. The supplied content does not provide a KB number or product-version-specific patch guidance for this CVE, so the authoritative remediation is to deploy the relevant Microsoft Patch Tuesday updates for all affected Word/Office installations as identified by Microsoft.