Microsoft May Patch Tuesday fixes 137 flaws, 31 critical

Microsoft released its May Patch Tuesday security update addressing 137 vulnerabilities, 31 of them rated critical. The company reported no zero-day flaws observed exploited in the wild. The fixes cover remote code execution weaknesses across Windows services, Office, Azure, SharePoint and graphics components.

The update repairs bugs that could allow an attacker to run code if a user opens a crafted file or if a system processes a malicious service response or image. Microsoft defines a zero-day as ‘a flaw in software for which no official patch or security update is available yet’ and has not observed any of the patched issues being exploited in production environments.

Two critical vulnerabilities are highlighted for immediate attention. CVE-2026-40361 is a use-after-free vulnerability in Microsoft Word with a CVSS score of 8.4. In use-after-free flaws, software frees a block of memory but keeps a reference to it; an attacker can sometimes reuse that freed memory to change program behavior. Opening or previewing a specially crafted Word document could allow arbitrary code execution with the privileges of the current user.

CVE-2026-35421 is a heap-based buffer overflow in the Windows Graphics Device Interface (GDI) with a CVSS score of 7.8. A buffer overflow occurs when input exceeds the space allocated in memory and overwrites adjacent areas. Microsoft notes that exploitation would require opening or processing a specially crafted Enhanced Metafile (EMF) file in Microsoft Paint to trigger the affected graphics functionality. Processing such a file could lead to code execution under the current user account.

Successful code execution at the user level can enable attackers to install malware, capture credentials or move laterally inside a network. The patches close the underlying memory and graphics processing errors that allow those actions.

Patches are available through Windows Update. On individual Windows devices, users can open Settings, go to Windows Update, check for updates and restart the system to complete installation. Organizations using patch management tools should schedule deployment according to their change control processes and prioritize the critical remote code execution fixes.

Monthly Patch Tuesday releases continue to cover a wide set of Microsoft products. This release contains multiple critical RCE issues related to document handling and graphics processing, and administrators are applying the updates to reduce exposure.