Main Vulnerability Database Vulnerabilities #VU131354

External Control of File Name or Path in Microsoft products - CVE-2026-40421

Published: May 13, 2026

Vulnerability identifier: #VU131354

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-40421

CWE-ID: CWE-73

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to external control of file name or path in Microsoft Word. A remote attacker can trick a victim to open a specially crafted Office file and gain access to sensitive information on the system.

Affected software

Microsoft 365 Apps for Enterprise
Microsoft Office
Microsoft Word
Microsoft Office LTSC

How to mitigate CVE-2026-40421

Install updates from vendor's website.

Microsoft Word - update to 16.0.5552.1000

External References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40421

Related Security Bulletins