This vulnerability (CVE-2026-40367) in Microsoft 365 Apps for Enterprise (Microsoft Office Word) is caused by an untrusted pointer dereference, which can lead to local code execution by an unauthorized attacker. The issue affects version 16.0.1 and has a CVSS 3.1 score of 8.4 with low attack complexity and no required privileges or user interaction. Microsoft has acknowledged the vulnerability and provided an official fix. The product is a cloud service, and the vendor manages remediation on their side. No active exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code locally, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. Given the CVSS score of 8.4, the impact is high. However, there are currently no known exploits in the wild.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure that their Microsoft 365 Apps for Enterprise environment is updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40367. Applying the official patch will mitigate the vulnerability.