Use after free in Microsoft Office Word

At face value, CVE-2026-40361 is a CWE-416 use-after-free in Microsoft Word that can lead to code execution in the context of the logged-in user. NVD ties it to Microsoft 365 Apps for enterprise, Word 2016, Office 2019, and Office LTSC 2021/2024 families, across x86/x64 and some Mac Office LTSC entries in the CPE list. Microsoft shipped fixes on 2026-05-12 as part of the May 2026 Office security updates, including KB5002858 for Word 2016 MSI.

The vendor 8.4 HIGH is too low for enterprise prioritization if the reported Outlook Preview Pane trigger is accurate. Multiple secondary sources citing Microsoft's advisory say the document can be weaponized through Preview Pane rendering and was marked Exploitation More Likely; that turns a nominally AV:L bug into an email-delivered client RCE with no open-attachment click, which is much closer to a zero-click endpoint compromise path than the raw CVSS suggests.

Why this verdict

• Upgraded because reach is broader than AV:L implies: if Outlook Preview Pane triggers the bug, the attacker only needs to land mail in a mailbox, not local code execution first.
• Huge exposed population: Office/Word/Outlook remain common on enterprise endpoints, so the reachable population is measured in user workstations, VDI pools, and shared terminal hosts, not a niche server role.
• No-auth, no-open path matters more than the low EPSS: once a client RCE rides standard email workflows, modern perimeter controls have to be perfect while the attacker only needs one rendered payload.
• Blast radius is user-context, not domain-admin by default: that keeps it below wormable infrastructure-tier flaws, but user-context on a knowledge-worker endpoint is still enough to steal mail, tokens, documents, and pivot.

Why not higher?

There is no verified KEV entry or confirmed in-the-wild exploitation in the reviewed sources. Also, this is still a client-side memory-corruption exploit whose final blast radius usually starts at the current user, not instant server-side or unauthenticated internet-service compromise.

Why not lower?

Downgrading this to ordinary HIGH would over-trust the vendor's AV:L label and ignore the reported inbox/Preview Pane delivery path. In a real enterprise, an email-borne no-open Office RCE is exactly the sort of bug that turns into widespread workstation compromise before asset owners finish debating CVSS semantics.

1. Prioritize classic Outlook + Office endpoints — Find Windows systems running classic Outlook with vulnerable Office builds and treat them as the highest-risk slice. For a CRITICAL noisgate verdict, complete this exposure triage and temporary risk reduction within 3 days.
2. Disable Preview Pane where operationally tolerable — If the business can absorb it, turn off Outlook Preview Pane or attachment preview handlers for high-risk groups to break the easiest trigger path. For this verdict, deploy the control within 3 days while patch rollout catches up.
3. Tighten Office child-process controls — Use ASR/AppLocker/WDAC/EDR policy to block Office apps from spawning script engines, LOLBins, and unsigned payloads. This does not fix the bug, but it meaningfully reduces post-exploitation reliability and should be pushed within 3 days.
4. Harden email handling for Office attachments — Increase detonation, quarantine, and external-attachment tagging for Word-bearing mail flows, especially for executives and finance users. As a compensating measure for a CRITICAL case, implement within 3 days.
5. Watch for Office crash-and-spawn patterns — Build detections around OUTLOOK.EXE or WINWORD.EXE followed by unusual child processes, memory dumps, script interpreters, or persistence writes. Detection tuning is part of mitigation and belongs within 3 days here.

Run this on the target Windows endpoint or through your software-deployment/remote shell tooling with standard user rights; admin is only needed if your environment restricts registry/process inspection. Invoke with powershell -ExecutionPolicy Bypass -File .\Test-CVE-2026-40361.ps1 and it will output PATCHED, VULNERABLE, or UNKNOWN based on Office inventory it can verify locally.

# Test-CVE-2026-40361.ps1

# Purpose: Local validation aid for CVE-2026-40361 exposure on Windows Office endpoints.

# Logic:

#   - PATCHED if Word 2016 MSI patch KB5002858 is installed.

#   - VULNERABLE if known affected Office family is present and Word 2016 MSI patch is missing.

#   - UNKNOWN for Click-to-Run/LTSC families where this script can detect presence but not channel-specific fixed build conclusively.

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=ERROR


$ErrorActionPreference = 'Stop'

function Write-Result {
    param(
        [string]$Status,
        [string]$Reason,
        [int]$Code
    )
    Write-Output ("{0}: {1}" -f $Status, $Reason)
    exit $Code
}

try {
    $officeUninstallRoots = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )

    $products = foreach ($root in $officeUninstallRoots) {
        Get-ItemProperty -Path $root -ErrorAction SilentlyContinue |
            Where-Object {
                $_.DisplayName -match 'Microsoft (Word|Office|Microsoft 365|Office LTSC|Office 2019|Office 2021|Office 2024)'
            } |
            Select-Object DisplayName, DisplayVersion, Publisher, InstallDate, PSChildName
    }

    $word2016Installed = $products | Where-Object { $_.DisplayName -match 'Word 2016' }
    $office2019Installed = $products | Where-Object { $_.DisplayName -match 'Office 2019' }
    $m365Installed = $products | Where-Object { $_.DisplayName -match 'Microsoft 365|Office 365|Microsoft 365 Apps' }
    $ltsc2021Installed = $products | Where-Object { $_.DisplayName -match 'LTSC 2021|Office 2021' }
    $ltsc2024Installed = $products | Where-Object { $_.DisplayName -match 'LTSC 2024|Office 2024' }

    $kb5002858 = Get-HotFix -Id KB5002858 -ErrorAction SilentlyContinue

    $ctrConfig = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' -ErrorAction SilentlyContinue
    $ctrVersion = $null
    if ($ctrConfig) {
        $ctrVersion = $ctrConfig.VersionToReport
        if (-not $ctrVersion) { $ctrVersion = $ctrConfig.ClientVersionToReport }
    }

    # Case 1: Conclusive patch evidence for Word 2016 MSI

    if ($word2016Installed -and $kb5002858) {
        Write-Result -Status 'PATCHED' -Reason 'Word 2016 detected and KB5002858 is installed.' -Code 0
    }

    # Case 2: Conclusive vulnerable evidence for Word 2016 MSI

    if ($word2016Installed -and -not $kb5002858) {
        Write-Result -Status 'VULNERABLE' -Reason 'Word 2016 detected and KB5002858 was not found.' -Code 1
    }

    # Case 3: Click-to-Run / LTSC families detected but fixed build not conclusively mapped offline

    if ($m365Installed -or $ltsc2021Installed -or $ltsc2024Installed -or $office2019Installed -or $ctrVersion) {
        $details = @()
        if ($m365Installed) { $details += 'Microsoft 365 Apps present' }
        if ($ltsc2021Installed) { $details += 'Office LTSC 2021 / Office 2021 present' }
        if ($ltsc2024Installed) { $details += 'Office LTSC 2024 / Office 2024 present' }
        if ($office2019Installed) { $details += 'Office 2019 present' }
        if ($ctrVersion) { $details += ('ClickToRun version=' + $ctrVersion) }

        Write-Result -Status 'UNKNOWN' -Reason ('Affected Office family detected but exact fixed build is channel-specific and not conclusively validated by this offline script. ' + ($details -join '; ')) -Code 2
    }

    # Case 4: No obvious affected Office family found

    Write-Result -Status 'UNKNOWN' -Reason 'No clearly affected local Office product was detected, or product inventory is incomplete.' -Code 2
}
catch {
    Write-Result -Status 'UNKNOWN' -Reason ('Script error: ' + $_.Exception.Message) -Code 3
}

Sources

1. NVD CVE-2026-40361
2. Microsoft Security Update Guide
3. Microsoft Support: May 2026 updates for Microsoft Office
4. Microsoft Support: Word 2016 security update KB5002858
5. Microsoft Learn: Update history for Microsoft 365 Apps
6. Microsoft Learn: Update history for Office LTSC 2024 and Office 2024
7. CISA Known Exploited Vulnerabilities Catalog
8. SecurityWeek coverage of Preview Pane trigger