Brief Summary: Microsoft Office Word CVE 2026 109503, a Double Free Reached Through PDF Export

Introduction

Microsoft's November 10, 2026 Patch Tuesday fixed a double free in Microsoft Office Word that can lead to code execution with the user's permissions when a crafted document is opened and then exported to PDF. The bug sits in an everyday workflow on both Windows and Mac builds of Office, and the fix ships inside a broad Word rollup rather than a standalone hotfix, so most organizations will close it through their normal Office channel updates.

Technical information

Root cause: CWE 415, Double Free

Microsoft classifies CVE 2026 109503 as CWE 415: Double Free. In this weakness class, the same heap allocation is released twice. That usually happens for one of two reasons: two code paths both believe they own an object, or a pointer stays live after its first free or delete.

The danger comes from what happens between the two releases. Once the first release returns the chunk to the allocator, that chunk can be handed out again and filled with attacker-controlled data. The second release then operates on memory that now belongs to something else, corrupting allocator metadata or a live object. CWE notes that the general consequences of this class include crashes, unexpected memory reads or writes, and in some circumstances code execution. For this specific CVE, Microsoft states that code execution is the outcome.

Where the bug lives

Microsoft has not published root cause details, and Word is closed source, so there is no public commit or diff to inspect. What we do have is the advisory FAQ, which says the vulnerable path runs when a user opens a crafted Word document and then exports it to PDF. That places the faulty ownership or cleanup logic in Word's document-to-PDF export pipeline, not in the initial parsing or preview path. The advisory also states explicitly that the Preview Pane is not an attack vector.

Scoring

Microsoft's base vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, for a score of 8.8 (High):

• AV:N: network attack vector. The attacker does not need local access to the victim system.
• AC:L: low attack complexity.
• PR:N: no privileges required. The advisory says the attacker needs no account on the affected system.
• UI:R: user interaction required, specifically opening the supplied document and exporting it to PDF.
• S:U / C:H / I:H / A:H: unchanged scope with high impact to confidentiality, integrity, and availability.

The temporal vector ends in RL:O/RC:C, meaning an Official Fix is available and Microsoft has confirmed the bug.

Attack flow

Based on Microsoft's description, exploitation follows this sequence:

1. The attacker prepares a specially crafted Word document intended to drive the PDF export code into the double free condition.
2. The attacker gets the document to the target. The CVSS vector scores this as network based, but the advisory does not specify a particular delivery mechanism.
3. The attacker persuades the user to open the document and then export it to PDF. Previewing the file in the Preview Pane does not trigger the bug.
4. During export, an object in the export pipeline is released twice. If the freed chunk is reallocated with attacker-controlled content between the two releases, the second release corrupts allocator state or a live object.
5. That corruption is leveraged into code execution running with the permissions of the user who performed the export.

The need for an explicit export action is a real constraint on the attacker, and it fits Microsoft's exploitability rating described below.

Exploitation status at publication

At publication, Microsoft's advisory marked the issue as not publicly disclosed and not exploited, rated exploitation Less Likely, and listed exploit code maturity as Unproven. The NVD record is awaiting enrichment and does not add a later assessment. No threat actor is named in the reviewed material. These assessments describe the situation at publication time and do not confirm that exploitation cannot occur.

Patch information

Microsoft fixed CVE 2026 109503 in its November 10, 2026 Patch Tuesday release, and MSRC lists every affected product as fixed. The fix ships only as updated Office binaries, identified by build number.

What the fix likely involves. Microsoft has not described the code change. Fixes for double free bugs usually do one or more of the following: make a single component the clear owner of the object, null out the pointer immediately after the first release, or restructure error and cleanup paths so an object is not freed both on an early-exit branch and in a later destructor. Without a public diff, we cannot confirm which approach Microsoft took. Researchers who want specifics would need to binary diff Word builds from before and after the November release, focusing on the PDF export code.

Fixed builds (per MSRC affected product data and NVD):

• Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140
• Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048
• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): channel specific, see aka.ms/OfficeSecurityReleases
• Microsoft Office 365 for Mac, Office LTSC for Mac 2021, Office LTSC for Mac 2024: 16.115.26110837

Click to Run channel builds. Microsoft's November 10, 2026 Office security release notes list CVE 2026 109503 under Word with these builds:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: 2610 (Build 20527.20194), 2609 (Build 20430.20264), 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel: 2610 (Build 20527.20192), 2609 (Build 20430.20262), 2608 (Build 20326.20318)
• Office 2024 and 2021 Retail: Version 2610 (Build 20527.20196)
• Office LTSC 2024 Volume Licensed: Version 2408 (Build 17932.21140)
• Office LTSC 2021 Volume Licensed: Version 2108 (Build 14334.21048)

The same November rollup includes other Word CVEs alongside this one, such as CVE 2026 109501 and CVE 2026 109505. Installing the build for your channel fixes all of them together. There is no separate hotfix for this bug alone.

The advisory does not document any workaround, configuration change, or temporary prevention step, so the update is the only vendor-supplied remediation.

Verifying the fix. In any Word app, open File > Account > About Word and compare the version and build against the lists above. Any build at or above the listed number for your channel includes the fix. On Mac, the threshold is 16.115.26110837.

Affected systems and versions

The NVD record lists the following affected ranges. In each case the upper bound is exclusive, meaning the listed build is the first fixed build.

• Microsoft 365 Apps for Enterprise: from 16.0.1, up to the boundary defined by Microsoft Office Security Releases (NVD uses this reference rather than a numeric upper version; see the channel builds above)
• Microsoft Office 365 for Mac: from 1.0.0, below 16.115.26110837
• Microsoft Office LTSC 2021: from 16.0.1, below 16.0.14334.21048
• Microsoft Office LTSC 2024: from 16.0.0, below 16.0.17932.21140
• Microsoft Office LTSC for Mac 2021: from 16.0.1, below 16.115.26110837
• Microsoft Office LTSC for Mac 2024: from 16.0.0, below 16.115.26110837

The vulnerable configuration is any unpatched build in these ranges where a user opens an attacker-supplied document and exports it to PDF.

References

• NVD entry for CVE 2026 109503
• Microsoft Security Update Guide: CVE 2026 109503, Microsoft Office Word Remote Code Execution Vulnerability
• MSRC API: vulnerability record for CVE 2026 109503
• MSRC API: affected product data for CVE 2026 109503
• Release notes for Microsoft Office security updates (Microsoft Learn)
• CWE 415: Double Free (MITRE)
• Microsoft Security Response Center mission
• MSRC FAQs: report an issue and submission guidelines
• Microsoft Vulnerability Research (MSVR)
• Microsoft fiscal 2026 Form 10 K
• Microsoft Security Blog: endpoint security market share data attributed to IDC