This vulnerability (CVE-2026-40366) is a use-after-free issue categorized under CWE-416 in Microsoft Office Word within Microsoft 365 Apps for Enterprise. It arises from accessing a resource using an incompatible type, leading to type confusion. This flaw allows an unauthorized attacker to execute code locally on the affected system. The CVSS 3.1 score is 8.4 (high), indicating significant impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are reported in the wild at this time.

Successful exploitation of this vulnerability could allow an unauthorized attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The high CVSS score reflects the critical nature of the impact if exploited.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40366 to mitigate this vulnerability.