CVE-2026-40364 is a type confusion vulnerability (CWE-843) in Microsoft Office Word within Microsoft 365 Apps for Enterprise version 16.0.1. This flaw allows unauthorized local code execution by accessing a resource using an incompatible type. The vulnerability has a CVSS 3.1 base score of 8.4, indicating high severity with local attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits have been reported in the wild.

Successful exploitation of this vulnerability allows an attacker to execute code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the system. The vulnerability does not require user interaction or privileges, increasing its risk. However, no known exploits are currently active in the wild.

An official fix is available from Microsoft. Since this vulnerability affects a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should consult the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40364 and ensure that their Microsoft 365 Apps for Enterprise installations are updated to the fixed version. No additional mitigation actions are indicated by the vendor.