VulnSocial

CVE-2015-6172Patch(microsoft / office)

LOWCVSS 9.3 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch microsoft office systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2016, Word 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted email message processed by Outlook, aka "Microsoft Office RCE Vulnerability."

microsoft CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-20

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • office
  • office_compatibility_pack
  • word

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
microsoft
Products
officeoffice_compatibility_packword

3 versions affected across 3 products

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-05-14: 1Patch / Workaround · 2026-05-14: 1Technical Details · 2026-05-14: 105-14
Signal classification1 categories
Patch
1100.0%
Full discourse1 post
  • Elusive@ElusivePrivacy
    Patch

    1/2 Microsoft patches CVE-2026-40361 zero-click RCE in Outlook via preview pane. Use-after-free in email rendering DLL shared with Word. No user interaction needed. Researcher Haifei Li (Expmon) compares it to BadWinmail (CVE-2015-6172), the "enterprise killer" from 2015.

    Post summary

    Microsoft has issued a patch for CVE‑2026‑40361, a zero‑click RCE in Outlook that exploits a use‑after‑free bug in the preview pane. No evidence of active exploitation or PoC is mentioned.

    11010114
    172 followersView on X
CPE platform detail7 entries

7 of 7 entries

PartVendorProductVersionTarget SWTarget HW
Appmicrosoftoffice2010--
Appmicrosoftoffice2010--
Appmicrosoftoffice_compatibility_pack---
Appmicrosoftword2007--
Appmicrosoftword2010--
Appmicrosoftword2013--
Appmicrosoftword2013--

Explore more

Back to dashboardmicrosoft CVEsoffice vulnerabilities