Microsoft Patches Critical Office and Word Use-After-Free RCE Flaws
Vulnerability Disclosure · 8 sources · Updated 4mo ago · First seen May 25, 2026
Microsoft disclosed and fixed two critical use-after-free vulnerabilities affecting Microsoft Office and Microsoft Word: CVE-2026-40358 and CVE-2026-40366. Both bugs are classified as CWE-416 and carry a CVSS 8.4 rating, with Microsoft assessing impacts to confidentiality, integrity, and availability as high. The company said neither flaw had been publicly disclosed or exploited in the wild at the time of publication, and it rated exploitation as less likely.
Microsoft said the vulnerabilities can lead to remote code execution, although the attack vector is described as local, with the Preview Pane able to serve as an attack path when malicious content is handled. The disclosures continue a broader pattern of Microsoft patching multiple remote code execution issues across its product line, including earlier Office flaws such as CVE-2024-30101, CVE-2025-24080, and CVE-2025-59234, as well as RCE bugs in Windows Connected Devices Platform Service, Remote Desktop Protocol, and Inbox COM Objects.
