# Critical Zero-Interaction Outlook/Word RCE

### **Alert Essentials**

Microsoft’s May 2026 Patch Tuesday patched **CVE-2026-40361**, a critical use-after-free (Remote Code Execution) flaw in Microsoft Office Word. Microsoft explicitly confirms the **Outlook Reading/Preview Pane is a viable attack vector** — previewing a malicious email is sufficient to trigger exploitation. No attachment needs to be opened. No user action required beyond rendering the message. Microsoft rates this _“Exploitation More Likely.”_ A patch is available. Deploy it now.

### **Threat Description**

CVE-2026-40361 is a use-after-free vulnerability in a DLL shared by both Microsoft Word and Outlook’s rendering engine (CWE-416). When Outlook’s Preview Pane processes a crafted document, the Word parser corrupts memory and redirects execution — granting the attacker code execution at the logged-in user’s privilege level. Traditional email controls (attachment blocking, link filtering) do not stop this attack because exploitation occurs during rendering, not user interaction with an attachment.

Researcher Haifei Li (Expmon) reported the flaw and compared it directly to CVE-2015-6172 (“BadWinmail”), an Outlook “enterprise killer” with the same attack vector. Li has developed a PoC demonstrating memory corruption; a fully weaponized exploit achieving reliable RCE has not been publicly confirmed. Three additional Word RCEs shipped in the same release — CVE-2026-40364 (also “Exploitation More Likely”), and CVE-2026-40366/40367 (“Less Likely”) are covered by the same patch.

### **Healthcare Impact**

Healthcare environments are high-value targets with heavy inbound email from external parties, referrals, payers, and vendors, making Outlook the most exposed attack surface. A single crafted email reaching a clinical workstation or administrative endpoint could grant an attacker an initial foothold, bypassing perimeter controls entirely. From there, lateral movement to EHR systems, networked medical devices, or backup infrastructure is a short path, with ransomware deployment and HIPAA breach implications following rapidly. Patch priority should be elevated accordingly.

| CVE | Impacted Versions | Fix | CVSS | CWE | CISA KEV | Tenable Plugin |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-40361 | M365 Apps, Office 2024/2021/2019/2016 | May 2026 Patch Tuesday (May 12, 2026) | 8.4 | CWE-416 | No | [314343](https://www.tenable.com/plugins/nessus/314343) |

### **Recommendations**

**Patching**

- Apply the May 2026 Patch Tuesday update immediately across all M365 Apps and Office 2024/2021/2019/2016 endpoints — via Windows Update, [Microsoft Update Catalog](https://catalog.update.microsoft.com/), or [Microsoft 365 Admin Center](https://config.office.com/).
- Verify minimum build: M365 Apps → Version 2504, Build 18730.20052+. Confirm via File → Account → About in any Office app.
- Run Tenable Plugin [314343](https://www.tenable.com/plugins/nessus/314343) to identify unpatched hosts before and after deployment.

**Compensating Controls (Pre-Patch)**

- Disable the Outlook Reading/Preview Pane org-wide via Group Policy: User Configuration → Administrative Templates → Microsoft Outlook → Outlook Options → Reading Pane → Disabled
- Force plain text email display: File → Options → Trust Center → Trust Center Settings → Email Security → ☑ Read all standard mail in plain text.

**Detection**

- Hunt in SentinelOne Deep Visibility for anomalous child processes spawned by OUTLOOK.EXE or WINWORD.EXE (cmd.exe, powershell.exe, wscript.exe, mshta.exe). Use OriginalFileName metadata — not process name alone — to prevent bypass.
- Alert on outbound network connections initiated by OUTLOOK.EXE or WINWORD.EXE to non-Microsoft external IPs.

**Admin / Executive**

- Treat this as a P1 patch deployment — “Exploitation More Likely” plus a confirmed PoC warrants immediate action, not standard patch cadence.
- If exploitation is discovered during the patching window, assess HIPAA breach risk analysis obligations for any PHI-bearing systems reachable from a compromised endpoint.

### Reference Links

- Microsoft MSRC CVE-2026-40361: [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40361](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40361)
- Microsoft Office Security Updates (May 2026): [https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates](https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates)
- Tenable May 2026 Patch Tuesday: [https://www.tenable.com/blog/microsofts-may-2026-patch-tuesday-addresses-118-cves-cve-2026-41103](https://www.tenable.com/blog/microsofts-may-2026-patch-tuesday-addresses-118-cves-cve-2026-41103)
- Tenable Plugin 314343: [https://www.tenable.com/plugins/nessus/314343](https://www.tenable.com/plugins/nessus/314343)
- CISA KEV Catalog: [https://www.cisa.gov/known-exploited-vulnerabilities-catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

* * *