This vulnerability (CVE-2026-40367) is a type confusion issue in Microsoft Office Word within Microsoft 365 Apps for Enterprise. It allows unauthorized local code execution by accessing resources using incompatible types. The vulnerability has a CVSS 3.1 base score of 8.4, indicating high severity, with low attack complexity, no privileges required, and no user interaction needed. Microsoft has released an official fix and manages remediation for this cloud service. No known exploits are reported in the wild at this time.

Successful exploitation could allow an attacker to execute arbitrary code locally with high impact on confidentiality, integrity, and availability. The vulnerability requires local access but no privileges or user interaction, making it a significant risk if an attacker can execute code locally on affected systems.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure that their Microsoft 365 Apps for Enterprise environment is updated according to Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40367 to mitigate this vulnerability.