KB5002866 Patches Two Critical Office 2016 Remote Code Execution Flaws

Microsoft released KB5002866 on May 12, 2026, as part of its monthly Patch Tuesday cycle. The update resolves two distinct remote code execution vulnerabilities in Microsoft Office 2016 MSI-based editions.

CVE-2026-40358 is a use-after-free flaw classified under CWE-416. Per SentinelOne's analysis, it stems from improper memory handling when Office processes document content. An attacker can craft a malicious Office file that, once parsed, triggers code execution in the context of the current user.

CVE-2026-40363 is a heap-based buffer overflow classified under CWE-122. Per SentinelOne's CVE database, the flaw results from missing or incorrect length validation in a heap allocation routine during document processing. Both carry a CVSS 3.1 base score of 8.4, per CrowdStrike's May 2026 Patch Tuesday report.

The update applies to MSI-based Office 2016 only. It doesn't cover Click-to-Run editions such as Microsoft 365, per Microsoft's own KB article.

Preview Pane exploitation lowers the attack bar significantly. A user doesn't need to open the malicious file; simply selecting it in File Explorer or Outlook triggers the parsing flaw. Sophos confirmed in their May 2026 Patch Tuesday recap that all six Office RCE vulnerabilities disclosed that month, including CVE-2026-40358 and CVE-2026-40363, are exploitable via Preview Pane.

Microsoft's exploitability index rates both CVEs as 'Exploitation More Likely,' meaning the company believes functional exploit code could be created consistently. No public proof-of-concept code has been reported so far, but the combination of low exploitation complexity and Preview Pane as an attack vector makes rapid weaponization plausible.

Office 2016 reached end of support on October 14, 2025, per Microsoft Learn. Microsoft continues issuing discretionary security patches, but organizations relying on these should plan their migration to a supported Office version.

KB5002866 targets Microsoft Office 2016 MSI-based editions in both 32-bit and 64-bit architectures. This includes Home and Student, Home and Business, Professional, and Professional Plus variants. The update is compatible with Windows 10 (all versions), Windows 11, and Windows Server 2016, 2019, and 2022.

Click-to-Run editions of Office 2016, including those delivered through Microsoft 365 subscriptions, are not covered by this KB. Those installations receive security fixes through the Click-to-Run update channel, which is handled separately. Microsoft's KB article states this explicitly.

KB5002866 supersedes KB5002859, the April 2026 security update. Administrators who already deployed KB5002859 still need to install this newer update to address the May vulnerabilities.

CVE-2026-40358 exploits improper memory handling in Office's document processing pipeline. Per SentinelOne's analysis, the vulnerability involves a freed memory object that Office continues to reference during parsing. Attackers can manipulate this dangling pointer to redirect execution flow. The flaw requires no privileges and no user interaction once the payload reaches the target. Successful exploitation grants code execution at the victim user's privilege level.

Detection indicators include unexpected child processes spawned by Office executables (winword.exe, excel.exe, powerpnt.exe, outlook.exe), particularly cmd.exe, powershell.exe, or rundll32.exe.

CVE-2026-40363 results from missing bounds checking during heap allocation in document processing. Per SentinelOne's CVE database entry, an attacker crafts a document with structures that exceed expected buffer sizes, causing heap corruption. This can overwrite function pointers or virtual table entries. The CVSS 3.1 base score is 8.4 with high impact on confidentiality, integrity, and availability.

Tenable's Nessus plugin 314350 provides detection coverage for both vulnerabilities based on application version checks.

KB5002866 is available through Microsoft Update (automatic delivery), the Microsoft Update Catalog (manual download), and enterprise patch management tools like WSUS and SCCM.

Prerequisites include having the release (MSI) version of Office 2016 installed with Service Pack 1 or later. All Office applications must be closed during installation. A system restart isn't required, but Office apps need to be restarted to apply the security fixes.

Administrators can verify installation with PowerShell:

Get-HotFix -Id KB5002866

For organizations unable to patch immediately, SentinelOne recommends enabling Protected View to sandbox documents from the internet or email, configuring Attack Surface Reduction rules to block Office child process creation, and restricting legacy file formats through File Block policies.

Microsoft fixed 132 CVEs across its product portfolio in May 2026, per Sophos, including 29 critical-severity issues. The May Patch Tuesday also addressed CVE-2026-40361 and CVE-2026-40364 in Microsoft Word, which Microsoft flagged as more likely to be exploited within 30 days.

Office 2016's extended support ended in October 2025. Microsoft's decision to continue issuing patches is discretionary and could stop at any time. Organizations still on Office 2016 should treat each patch cycle as a reminder to plan migration to Microsoft 365 Apps or Office LTSC 2024.

No active exploitation of CVE-2026-40358 or CVE-2026-40363 has been reported so far, but the 'Exploitation More Likely' rating and Preview Pane attack vector make these high-priority patches for defenders.

Unpatched Office 2016 MSI installations are exposed to two critical remote code execution vulnerabilities exploitable through Preview Pane.

Security: Two CVSS 8.4 RCE vulnerabilities with Exploitation More Likely rating.

KB5002866 addresses two critical remote code execution vulnerabilities in Office 2016, both exploitable through Preview Pane. The update is available for MSI editions only and supersedes KB5002859.