Introduction
Most malicious Word documents are dangerous as soon as they are opened. CVE 2026 109501 has a narrower trigger: the crafted file has to be opened and then exported to PDF. Microsoft still rates this out-of-bounds read in Word at CVSS 3.1 8.8, with code execution as the impact. The November 2026 fix should go into every Office patch cycle on Windows and Mac, even though Microsoft currently assesses exploitation as Less Likely.
At publication on November 10, 2026, Microsoft reported that the issue had not been publicly disclosed or exploited, and it rated exploit code maturity as Unproven. The CISA Known Exploited Vulnerabilities catalog content we reviewed did not list this CVE, and no source we reviewed named a threat actor or campaign. Kentaro Kawane of GMO Cybersecurity by Ierae, Inc. reported the bug through coordinated disclosure.
Technical information
Root cause
Microsoft classifies the weakness as CWE 125, Out of bounds Read, with Remote Code Execution as the impact. The advisory FAQ says the vulnerable code runs when a user opens a crafted document and exports it to PDF. The Preview Pane is explicitly not an attack vector. That places the flaw in Word's document parsing and PDF export path rather than in the preview handler.
Word is closed source, and Microsoft has published no diff, commit, or function-level detail. In general, a CWE 125 fix checks an index or length taken from untrusted file data against the actual size of the buffer before the read happens. We cannot confirm the exact code change in Word, and the public record does not explain how the out-of-bounds read leads to code execution. We are not going to guess at those mechanics.
Scoring
The vector Microsoft supplied, including temporal metrics:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Base score: 8.8 (High) Temporal score: 7.7 Max severity: Important
In plain terms:
- AV:N, AC:L, PR:N: the attack is reachable over the network, has low complexity, and needs no prior privileges. Microsoft notes the attacker needs no account on the affected system.
- UI:R: a user has to act. In this case, that means opening the file and exporting it to PDF.
- S:U, C:H/I:H/A:H: scope is unchanged, and confidentiality, integrity, and availability impact are rated high. Code runs with the user's permissions.
- E:U/RL:O/RC:C: exploit code is Unproven, an Official Fix exists, and the report is Confirmed. Together these lower the temporal score from 8.8 to 7.7.
These are scoring characteristics. They do not mean every successful attack produces the maximum impact in every environment.
NVD shows the 8.8 High score supplied by Microsoft as the CNA. Its own assessment is not yet available, and the record is marked Awaiting Enrichment.
Attack flow
Based on the advisory, exploitation would follow these steps:
- The attacker builds a specially crafted Word document.
- The attacker delivers the document to a target over the network. The advisory does not specify a delivery channel.
- The target opens the document in a vulnerable Word build. Previewing it in the Preview Pane does not trigger the bug.
- The target exports the document to PDF, which runs the vulnerable parsing and export code.
- The out-of-bounds read occurs. According to Microsoft, successful exploitation runs code with the permissions of the logged-in user.
The requirement for both opening and exporting is a real constraint, and it is part of why Microsoft rates exploitation as Less Likely. Exporting to PDF is still a normal workflow, and an attacker can prompt it with ordinary pretexts.
Known gaps
The public sources do not provide exploit code, the internal vulnerable function, a named threat actor, a confirmed campaign, or an NVD assessment.
Patch information
Microsoft fixed CVE 2026 109501 in its November 10, 2026 Patch Tuesday release. The advisory lists the Remediation Level as Official Fix. Microsoft's Security Update Guide API marks all nine affected product rows as "productStatus":"fixed" with "customerActionRequired":true. A fix exists, but systems are not protected until the update is installed. The advisory is at revision 1.0 and has not changed since publication.
Fixed builds (any older build is vulnerable):
- Microsoft Office LTSC 2024 (32 bit and 64 bit):
16.0.17932.21140, via Microsoft 365 Apps security updates - Microsoft Office LTSC 2021 (32 bit and 64 bit):
16.0.14334.21048, via Microsoft 365 Apps security updates - Microsoft 365 Apps for Enterprise (32 bit and 64 bit): depends on the Click to Run servicing channel. See Office Security Releases
- Microsoft Office 365 for Mac:
16.115.26110837, via Office for Mac release notes - Microsoft Office LTSC for Mac 2021:
16.115.26110837 - Microsoft Office LTSC for Mac 2024:
16.115.26110837
Rollout notes
- Microsoft 365 Apps for Enterprise has no single fixed build number. Each Click to Run channel (Current, Monthly Enterprise, Semi Annual) has its own fixed build for the November 2026 release, and MSRC points to the release notes instead of listing one. Look up the build for your channel and check it under File > Account > About. Do not assume one version string covers every channel.
- Office 365 for Mac, LTSC for Mac 2021, and LTSC for Mac 2024 all move to the same build,
16.115.26110837, usually through Microsoft AutoUpdate. - LTSC Windows editions have one fixed build per release line (2021:
16.0.14334.21048; 2024:16.0.17932.21140). To check compliance, compare the installed build against these numbers.
The advisory documents no workaround or configuration change that replaces installing the update.
Affected systems and versions
NVD lists the affected ranges using Microsoft's CNA data:
- Microsoft Office LTSC 2021 for Windows (32 bit and 64 bit): from
16.0.1up to, but not including,16.0.14334.21048 - Microsoft Office LTSC 2024 for Windows (32 bit and 64 bit): builds earlier than
16.0.17932.21140 - Microsoft Office 365 for Mac, Office LTSC for Mac 2021, Office LTSC for Mac 2024: all builds up to, but not including,
16.115.26110837 - Microsoft 365 Apps for Enterprise (32 bit and 64 bit): builds earlier than the November 2026 fixed build for the installed servicing channel
The vulnerable configuration is any of these builds where a user opens an untrusted Word document and exports it to PDF.
Vendor security history
The sources we reviewed do not list earlier Word CVEs. They do include broader context on Microsoft's security record. The Cyber Safety Review Board report on the 2023 Exchange Online intrusion found that Storm 0558's possession of a 2016 MSA key, combined with access to enterprise Exchange accounts, gave it access to any Exchange Online account. The Board called for security culture reforms and a public plan with specific timelines for security-focused reforms across Microsoft products. The report also notes the Secure Future Initiative, which Microsoft announced in November 2023. That incident involved a different service and has no established connection to this Word vulnerability.
References
- Microsoft Security Update Guide: CVE 2026 109501
- MSRC Security Update Guide API: affected products for CVE 2026 109501
- NVD entry for CVE 2026 109501
- CVE Record for CVE 2026 109501
- Release notes for Microsoft Office security updates
- Office for Mac release notes
- Office Security Releases (aka.ms)
- CISA Known Exploited Vulnerabilities Catalog
- isMalicious entry for CVE 2026 109501
- CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft 2026 Annual Report
- Microsoft Form 10K filing
