Microsoft Patches CVE-2026-40361, a Critical Zero-Click Outlook Flaw
Summary
Microsoft patched CVE-2026-40361, which it describes as a critical RCE flaw affecting Word. Researcher Haifei Li says it could enable zero-click RCE via Outlook email preview; his PoC is not a working exploit.
Key points
- CVE-2026-40361 was one of 137 vulnerabilities addressed in Microsoft’s Patch Tuesday updates.
- Microsoft describes the critical vulnerability as remote code execution affecting Word; researcher Haifei Li says it affects a DLL used by both Word and Outlook.
- Li characterizes it as a zero-click use-after-free that could enable remote code execution against Outlook users when they read or preview an email.
- Li demonstrated a proof of concept, but said he had not developed a working exploit that achieves code execution.
- Microsoft rated exploitation as “more likely.”
- Li said rendering emails in plain text is a valid mitigation, while other mitigation or blocking is difficult.
Article Details
- Vulnerability Types
- Remote code execution
- Use-after-free
- Severity
- Critical
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Configure Outlook to render emails only in plain text.
MITRE ATT&CK
CVE
CVE-2015-6172Vendor / Product unavailableThat flaw, tracked as CVE-2015-6172 and named BadWinmail, was dubbed an “enterprise killer” at the time by the researcher, and the new flaw has the same attack vector and the same potential impact.CVE-2026-40361Microsoft · Microsoft 365 Apps for Enterprise; Microsoft · Microsoft Office 2019; +5 moreThe Outlook vulnerability is tracked as CVE-2026-40361 and it has been described by Microsoft as a remote code execution vulnerability affecting Word.
People
Vendors
Products
Microsoft Exchange ServerIn a post on X, Li explained that the vulnerability affects a DLL used heavily by both Word and Outlook, and he demonstrated its potential impact in an Outlook and Exchange Server environment.OutlookOne of the 137 vulnerabilities patched by Microsoft with its Patch Tuesday updates is a critical Outlook flaw that could pose a serious threat to enterprises.WordThe Outlook vulnerability is tracked as CVE-2026-40361 and it has been described by Microsoft as a remote code execution vulnerability affecting Word.