Vulnerability intelligence
CVE-2026-40361
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS Score
8.4
High
EPSS — Exploit Probability
0.6%
Riskier than 47% of all CVEs · checked 2026-09-06
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
Patch available
Vendor fix published
3 articles across 3 outlets · first covered May 12, 2026 · latest May 13, 2026
Coverage timeline
-
Patch Tuesday Updates Fix 137 Flaws, Including Critical Word Bugwww.malwarebytes.com · May 13, 2026
-
Attackers can exploit CVE-2026-40361 via zero click Outlook flawwww.securityweek.com · May 13, 2026
-
Microsoft Patch May 2026 fixes 137 bugs, zero day freewww.darkreading.com · May 12, 2026