Critical Microsoft Vulnerability CVE-2026-40225 Affects Multiple Products with Active Exploitation

Microsoft has issued an urgent security advisory for CVE-2026-40225, a critical vulnerability affecting multiple products. The vulnerability allows remote code execution without authentication. Attackers are actively exploiting this vulnerability in targeted attacks.

The vulnerability affects:

• Windows 10 (version 1903 and later)
• Windows 11 (all versions)
• Microsoft Office 2019 and later
• Microsoft 365 Apps
• Azure services including Azure App Service and Azure Functions

CVSS severity: 9.8 (Critical)

Exploitation has been observed in the wild. Organizations should prioritize patching immediately.

Technical Details CVE-2026-40225 is a memory corruption flaw in the Microsoft Windows Graphics Component. The vulnerability exists due to improper handling of specially crafted image files. When a user opens a malicious image file, the vulnerability could allow remote code execution in the security context of the current user.

Attackers can exploit this vulnerability by convincing a user to open a malicious image file or by embedding the malicious file in a website that the user visits. No user interaction is required if the attacker can control the content that the user views.

Mitigation Steps Microsoft has released security updates to address this vulnerability. Organizations should apply the updates immediately.

For Windows systems:

• Install the latest security updates from the Microsoft Security Update Guide
• Enable automatic updates
• Use the Windows Update for Business deployment service

For Microsoft Office and Microsoft 365:

• Update to the latest version
• Use the Microsoft Update Health Tools to ensure all components are updated

For Azure services:

• Apply the platform updates as outlined in Azure Security Center
• Configure Azure services to use the latest supported runtime versions

Timeline

• Vulnerability discovered: December 2025
• Patch release: January 14, 2026
• Active exploitation observed: January 16, 2026
• Public disclosure: January 20, 2026

Organizations unable to patch immediately should implement the following mitigations:

• Block file types associated with the vulnerability at network boundaries
• Use application control solutions to prevent execution of untrusted applications
• Enable Windows Defender Antivirus with real-time protection
• Implement the Enhanced Mitigation Experience Toolkit (EMET) for additional protection

Microsoft has stated that they are not aware of any workarounds for this vulnerability. Patching is the only complete solution.

This vulnerability follows a pattern of increasing attacks targeting Microsoft products in 2025-2026. Security researchers have observed a 40% increase in attacks targeting Microsoft vulnerabilities compared to the previous year.

For additional information, refer to the official Microsoft Security Advisory and the CISA Alert AA26-001A.