Skip to content
Threat Feed
high advisory

CVE-2026-40361: Microsoft Office Word Use-After-Free Vulnerability

CVE-2026-40361 is a use-after-free vulnerability in Microsoft Office Word that allows an unauthorized attacker to execute code locally.

CVE-2026-40361 is a use-after-free vulnerability affecting Microsoft Office Word. This vulnerability allows an unauthorized attacker to execute code locally on a vulnerable system. The vulnerability resides in how Word handles certain objects in memory. If an object is freed and later accessed again, it can lead to arbitrary code execution. An attacker could potentially exploit this vulnerability by crafting a malicious Word document that, when opened, triggers the use-after-free condition. Successful exploitation could allow the attacker to execute arbitrary code in the context of the current user. This poses a significant risk to organizations as it could lead to data breaches, malware infections, or system compromise.

Attack Chain

  1. An attacker crafts a malicious Microsoft Word document containing a specially crafted object designed to trigger the use-after-free vulnerability (CVE-2026-40361).
  2. The attacker delivers the malicious Word document to the victim via email or other means of file transfer.
  3. The victim opens the malicious Word document using a vulnerable version of Microsoft Office Word.
  4. Word attempts to process the crafted object within the document.
  5. The vulnerability is triggered when Word attempts to access a memory location that has already been freed.
  6. The attacker gains control of the program counter due to the use-after-free condition.
  7. The attacker leverages this control to execute arbitrary code on the victim’s machine.
  8. The attacker can then perform malicious actions such as installing malware, stealing sensitive data, or gaining further access to the network.

Impact

Successful exploitation of CVE-2026-40361 allows an attacker to execute arbitrary code locally on the victim’s machine. This could lead to a complete compromise of the affected system, including data theft, malware installation, and lateral movement within the network. Given the widespread use of Microsoft Office Word, this vulnerability poses a significant risk to a large number of users and organizations.

Recommendation

  • Deploy the Sigma rules provided in this brief to your SIEM to detect potential exploitation attempts.
  • Apply the security update provided by Microsoft to patch CVE-2026-40361 in Microsoft Office Word as soon as possible. Reference: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40361
  • Educate users about the risks of opening unsolicited or suspicious Word documents to mitigate the initial access vector.
  • Enable and monitor process creation logs on endpoints to detect suspicious processes spawned by Microsoft Word.

Detection coverage 2

Detects CVE-2026-40361 Exploitation Attempt - Suspicious Child Process from Winword

high

Detects CVE-2026-40361 exploitation attempt - Monitors for suspicious processes spawned by Winword.exe, potentially indicating code execution.

sigma tactics: execution, privilege_escalation techniques: T1059.001 sources: process_creation, windows

Detects CVE-2026-40361 Exploitation Attempt - Winword Creating Unusual Files

medium

Detects CVE-2026-40361 exploitation attempt - Detects suspicious files written to disk by Microsoft Word (Winword.exe), possibly indicating successful exploitation.

sigma tactics: execution, persistence techniques: T1027 sources: file_event, windows

Detection queries are available on the platform. Get full rules →