This vulnerability (CVE-2026-40364) is a type confusion issue in Microsoft Office Word within Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute code locally by accessing a resource using an incompatible type. The CVSS v3.1 score is 8.4, indicating high severity with high impact on confidentiality, integrity, and availability. The vulnerability affects version 16.0.1 of the product. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation allows an unauthorized attacker to execute code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the affected environment.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40364 for detailed patching and update instructions.