Loading story…
Microsoft disclosed and patched CVE-2023-36563, an information disclosure vulnerability affecting Microsoft WordPad, through its Security Update Guide. The advisory identifies the issue as a flaw that could expose sensitive information from the affected application, adding WordPad to the list of Windows components requiring security updates.
Microsoft published the vulnerability entry in both its product advisory and Security Update Guide portals, but did not provide a public synopsis with technical exploitation details. Organizations using WordPad should review the official guidance for affected versions and deploy the relevant Microsoft security updates to reduce the risk of unintended data exposure.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft added CVE-2023-36563, a Microsoft WordPad information disclosure vulnerability, to its Security Update Guide. The two references describe the same advisory publication event.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and fixed two critical use-after-free vulnerabilities affecting **Microsoft Office** and **Microsoft Word**: `CVE-2026-40358` and `CVE-2026-40366`. Both bugs are classified as **CWE-416** and carry a **CVSS 8.4** rating, with Microsoft assessing impacts to confidentiality, integrity, and availability as high. The company said neither flaw had been publicly disclosed or exploited in the wild at the time of publication, and it rated exploitation as less likely. Microsoft said the vulnerabilities can lead to remote code execution, although the attack vector is described as **local**, with the **Preview Pane** able to serve as an attack path when malicious content is handled. The disclosures continue a broader pattern of Microsoft patching multiple remote code execution issues across its product line, including earlier Office flaws such as `CVE-2024-30101`, `CVE-2025-24080`, and `CVE-2025-59234`, as well as RCE bugs in Windows Connected Devices Platform Service, Remote Desktop Protocol, and Inbox COM Objects.
Jun 29, 2026
Microsoft has disclosed multiple **Microsoft Word remote code execution** flaws in its Security Update Guide, including `CVE-2026-40366`, `CVE-2026-40361`, and the earlier-listed `CVE-2026-33115`. The advisories identify all three issues as Word RCE vulnerabilities, indicating that specially crafted Word documents or related content could allow arbitrary code execution in affected environments. The newly published entries for `CVE-2026-40366` and `CVE-2026-40361` expand a growing set of Word security issues alongside `CVE-2026-33115`, underscoring continued risk around document-based attack paths in Microsoft Office. Organizations using Microsoft Word should review the corresponding Security Update Guide entries, prioritize patch deployment, and reinforce controls for untrusted document handling while assessing exposure across user endpoints.
Jul 12, 2026
Microsoft published security advisories for several **Microsoft Word Remote Code Execution** flaws, including `CVE-2026-40364`, `CVE-2026-40367`, and the earlier `CVE-2026-33114`, indicating multiple distinct code-execution issues affecting Word. The entries were released through the Microsoft Security Response Center's Security Update Guide and identify the vulnerabilities as capable of enabling remote code execution in the Office application. The disclosures point to an ongoing stream of Word security fixes rather than a single isolated bug, underscoring continued risk around malicious document handling in enterprise environments. Organizations that rely on Microsoft Office should review the affected product listings and associated updates for each CVE in the Security Update Guide and prioritize patch deployment for systems where Word is installed or used to open untrusted files.
Jul 12, 2026