A critical type confusion vulnerability in Microsoft Office Word allows for local code execution, necessitating immediate patching.

The software fails to correctly handle object types, leading to a type confusion vulnerability that can be exploited by an unauthenticated attacker to achieve local code execution.

The CVSS score of 8.4 highlights the high severity of this issue. Exploitation could allow an attacker to bypass security controls and execute arbitrary code, leading to total system compromise and potential impact on business confidentiality and integrity.

Immediate Action: Apply the vendor security updates immediately as outlined in the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40364.

Proactive Monitoring: Review system logs for anomalous activity and ensure that all Office software is kept up to date with the latest security baseline.

Compensating Controls: Use application control policies to restrict the execution of untrusted macros or Office add-ins that might facilitate the delivery of such exploits.

Public Exploit Available: No

Given the high impact and the potential for code execution, it is imperative that organizations apply the provided patches immediately. Proactive patching remains the most effective defense against this class of vulnerability.