CVE-2026-40367— Microsoft Word 安全漏洞
Possible ATT&CK Techniques 2AI
T1210 · Exploitation of Remote Services T1203 · Exploitation for Client ExecutionAffected Version Matrix 10
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise | 16.0.1< https://aka.ms/OfficeSecurityReleases | affected |
| Microsoft | Microsoft Office 2019 | 19.0.0< https://aka.ms/OfficeSecurityReleases | affected |
| Microsoft | Microsoft Office LTSC 2021 | 16.0.1< https://aka.ms/OfficeSecurityReleases | affected |
| Microsoft | Microsoft Office LTSC 2024 | 16.0.0< https://aka.ms/OfficeSecurityReleases | affected |
| Microsoft | Microsoft Office LTSC for Mac 2021 | 16.0.1< 16.109.26051019 | affected |
| Microsoft | Microsoft Office LTSC for Mac 2024 | 16.0.0< 16.109.26051019 | affected |
| Microsoft | Microsoft SharePoint Enterprise Server 2016 | 16.0.0< 16.0.5552.1002 | affected |
| Microsoft | Microsoft SharePoint Server 2019 | 16.0.0< 16.0.10417.20128 | affected |
| Microsoft | Microsoft SharePoint Server Subscription Edition | 16.0.0< 16.0.19725.20280 | affected |
| Microsoft | Microsoft Word 2016 | 16.0.1< 16.0.5552.1000 | affected |
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-40367の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Microsoft Word Remote Code Execution Vulnerability
ソース: NVD (National Vulnerability Database)
脆弱性説明
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
非可信指针解引用
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Microsoft Word 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Microsoft Word是美国微软（Microsoft）公司的一套Office套件中的文字处理软件。 Microsoft Word存在安全漏洞。攻击者利用该漏洞可以远程执行代码。以下产品和版本受到影响：Microsoft SharePoint Enterprise Server 2016,Microsoft SharePoint Server 2019,Microsoft Office 2019 for 32-bit editions,Microsoft Office 2019 for 64-bit
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise | 16.0.1 ~ https://aka.ms/OfficeSecurityReleases | - | |
| Microsoft | Microsoft Office 2019 | 19.0.0 ~ https://aka.ms/OfficeSecurityReleases | - | |
| Microsoft | Microsoft Office LTSC 2021 | 16.0.1 ~ https://aka.ms/OfficeSecurityReleases | - | |
| Microsoft | Microsoft Office LTSC 2024 | 16.0.0 ~ https://aka.ms/OfficeSecurityReleases | - | |
| Microsoft | Microsoft Office LTSC for Mac 2021 | 16.0.1 ~ 16.109.26051019 | - | |
| Microsoft | Microsoft Office LTSC for Mac 2024 | 16.0.0 ~ 16.109.26051019 | - | |
| Microsoft | Microsoft SharePoint Enterprise Server 2016 | 16.0.0 ~ 16.0.5552.1002 | - | |
| Microsoft | Microsoft SharePoint Server 2019 | 16.0.0 ~ 16.0.10417.20128 | - | |
| Microsoft | Microsoft SharePoint Server Subscription Edition | 16.0.0 ~ 16.0.19725.20280 | - | |
| Microsoft | Microsoft Word 2016 | 16.0.1 ~ 16.0.5552.1000 | - |
II. CVE-2026-40367の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-40367のインテリジェンス情報
请登录查看更多情报信息。
Same Patch Batch · Microsoft · 2026-05-12 · 125 CVEs total
| CVE-2026-42898 | 9.9 CRITICAL | Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability |
| CVE-2026-42823 | 9.9 CRITICAL | Azure Logic Apps Elevation of Privilege Vulnerability |
| CVE-2026-41089 | 9.8 CRITICAL | Windows Netlogon Remote Code Execution Vulnerability |
| CVE-2026-41096 | 9.8 CRITICAL | Windows DNS Client Remote Code Execution Vulnerability |
| CVE-2026-40379 | 9.3 CRITICAL | Azure Entra ID Spoofing Vulnerability |
| CVE-2026-40402 | 9.3 CRITICAL | Windows Hyper-V Elevation of Privilege Vulnerability |
| CVE-2026-42833 | 9.1 CRITICAL | Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability |
| CVE-2026-33117 | 9.1 CRITICAL | Azure SDK for Java Security Feature Bypass Vulnerability |
| CVE-2026-41103 | 9.1 CRITICAL | Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability |
| CVE-2026-40357 | 8.8 HIGH | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2026-41109 | 8.8 HIGH | GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability |
| CVE-2026-35436 | 8.8 HIGH | Microsoft Office Click-To-Run Elevation of Privilege Vulnerability |
| CVE-2026-40403 | 8.8 HIGH | Windows Graphics Component Remote Code Execution Vulnerability |
| CVE-2026-40420 | 8.8 HIGH | Microsoft Office Click-To-Run Elevation of Privilege Vulnerability |
| CVE-2026-35439 | 8.8 HIGH | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2026-41086 | 8.8 HIGH | Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability |
| CVE-2026-40370 | 8.8 HIGH | SQL Server Remote Code Execution Vulnerability |
| CVE-2026-34329 | 8.8 HIGH | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
| CVE-2026-33110 | 8.8 HIGH | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2026-41094 | 8.8 HIGH | Microsoft Data Formulator Remote Code Execution Vulnerability |
Showing 20 of 125 CVEs. View all on vendor page →
IV. 関連脆弱性
- CVE-2026-40420
Microsoft Office Click-To-Run Elevation of Privilege Vulnera - CVE-2026-35436
Microsoft Office Click-To-Run Elevation of Privilege Vulnera - CVE-2026-40418
Microsoft Office Click-To-Run Elevation of Privilege Vulnera - CVE-2026-40362
Microsoft Excel Remote Code Execution Vulnerability - CVE-2026-40361
Microsoft Word Remote Code Execution Vulnerability
同じベンダー: Microsoft
- CVE-2026-46383
Microsoft APM: Windows absolute-path tar member overwrite du - CVE-2026-45539
Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agen - CVE-2026-44641
Microsoft APM: plugin.json component paths escape plugin roo - CVE-2026-41615
Microsoft Authenticator Information Disclosure Vulnerability - CVE-2026-42897
Microsoft Exchange Server Spoofing Vulnerability
V. CVE-2026-40367へのコメント
まだコメントはありません