CVE-2026-40366 Details

A use-after-free vulnerability has been identified in Microsoft Office Word. This issue allows an unauthorized attacker to execute code locally on the affected system. The vulnerability arises from improper memory management, which can be exploited to execute arbitrary code.

Users can download the security update for this vulnerability through the Microsoft Update Catalog. For Microsoft Word 2016 (both 32-bit and 64-bit editions), the security update is available as part of the May 2026 security updates. Instructions for downloading the update are provided in the Microsoft Knowledge Base article 5002858. For other affected Microsoft Office products, security updates can be downloaded via the Microsoft Update mechanism or through the Office Update service.