This vulnerability, identified as CVE-2026-40364, is a type confusion issue (CWE-843) in Microsoft Office Word within Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute code locally by accessing resources using incompatible types. The CVSS v3.1 base score is 8.4, indicating high severity with impacts on confidentiality, integrity, and availability. The vulnerability affects version 16.0.1. Microsoft has issued an official fix and manages remediation for this cloud service. No active exploitation has been reported.

Successful exploitation allows an unauthorized attacker to execute code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the affected application environment.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure that their Microsoft 365 Apps for Enterprise environment is updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40364.