word vulnerabilities and fixes

Recent CVEs affecting word, with upgrade or downgrade steps. 13 tracked.

word has 13 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-09-08. Highest priority: CVE-2026-40364 (score 57/100).

• CVE-2026-40364 HIGH 8.4 MITIGATE DOWNGRADE Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized
• CVE-2026-40361 HIGH 8.4 MITIGATE DOWNGRADE Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-40367 HIGH 8.4 MITIGATE DOWNGRADE Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized
• CVE-2026-40366 HIGH 8.4 MITIGATE DOWNGRADE Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized
• CVE-2026-41101 HIGH 7.1 UPGRADE Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.
• CVE-2026-42832 HIGH 7.7 UPGRADE DOWNGRADE Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.
• CVE-2026-35440 MEDIUM 5.5 MITIGATE DOWNGRADE Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker t
• CVE-2026-40421 MEDIUM 4.3 MITIGATE DOWNGRADE Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker t
• CVE-2026-69764 HIGH 8.8 MITIGATE MITIGATE Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a net
• CVE-2026-78522 MEDIUM 6.5 MITIGATE MITIGATE Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a net
• CVE-2026-80079 MEDIUM 6.5 MITIGATE MITIGATE Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a net
• CVE-2026-83949 MEDIUM 5.5 MITIGATE MITIGATE Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
• CVE-2026-83951 MEDIUM 5.5 MITIGATE MITIGATE Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

FAQ

How do I fix word vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is word being exploited right now?

None of the tracked word CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which word CVE should I patch first?

CVE-2026-40364 currently ranks highest (57/100): Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized .

RSS feed for word · ← Back to latest CVEs