CVE-2026-40361 is a zero-click use-after-free vulnerability in a DLL used by both Microsoft Word and Outlook, enabling remote code execution when an email is previewed or read. The vulnerability bypasses traditional enterprise defenses by delivering the exploit directly to the inbox without requiring user interaction. It shares characteristics with the 2015 BadWinmail vulnerability, known for its severe impact on enterprises. The vulnerability was reported by Haifei Li, who also developed a proof-of-concept. Microsoft has assigned an 'exploitation more likely' rating and included the fix in its Patch Tuesday security updates. Mitigation options are limited due to the flaw residing in the email rendering engine, though forcing plain text rendering can reduce risk.

Successful exploitation of CVE-2026-40361 allows remote code execution on affected systems running Microsoft Outlook and Word, potentially compromising enterprise environments. The zero-click nature means attackers can compromise targets simply by sending a crafted email, bypassing user interaction and many traditional security controls. This vulnerability poses a critical risk to high-value targets such as executives, as it can be triggered immediately upon email preview. Microsoft’s rating of 'exploitation more likely' indicates a significant threat level, although no confirmed in-the-wild exploits have been reported at this time.

Microsoft has released an official patch for CVE-2026-40361 as part of its Patch Tuesday updates; applying this update is the primary recommended mitigation. Additionally, configuring Outlook to render emails in plain text format can help mitigate exploitation risk, though this is a partial workaround. Since the vulnerability resides in the email rendering engine and is triggered without user interaction, other mitigations are limited. Organizations should prioritize patch deployment to affected systems promptly.