CVE-2026-40367
High · 8.4CVSS
8.4
EPSS
0.5%
Published
May 12, 2026
CISA due date
—
The record
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-88781 Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level… CWE-822
- CVE-2026-19676 The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in… CWE-822
- CVE-2026-110322 The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned… CWE-822
- CVE-2026-83848 Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized… CWE-822
- CVE-2026-83826 Untrusted pointer dereference in Windows Error Reporting allows an authorized attacker to… CWE-822
- CVE-2026-83587 Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to… CWE-822
- CVE-2026-70275 Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to… CWE-822
- CVE-2026-70270 Untrusted pointer dereference in Windows Container Isolation FS Filter Driver allows an… CWE-822