Brief Summary: Microsoft Word CVE-2026-109505 Stack-Based Buffer Overflow Leading to Remote Code Execution

Introduction

A stack-based buffer overflow in Microsoft Word, fixed in the November 10, 2026 Patch Tuesday release, can give an attacker code execution with the permissions of the user who handles a crafted document. The trigger is narrow. The victim has to open the file, start recording a macro, and then apply a style supplied by that document. That makes this a high-impact bug with a well-defined interaction chain rather than a one-click compromise.

Microsoft rates CVE-2026-109505 as Important, with a CVSS 3.1 base score of 8.8 and a temporal score of 7.7. At publication, Microsoft reported no exploitation in the wild, no prior public disclosure, and an assessment of Exploitation Less Likely. Below we summarize what is known about the flaw, the exact fixed builds for each Office product line, and how to confirm a given install is patched.

Technical information

Root cause

Microsoft classifies the defect as CWE 121, a stack-based buffer overflow. MITRE defines this weakness as writing beyond the end of a buffer allocated on the stack, with general consequences that can include crashes and arbitrary code execution. Those are characteristics of the weakness class. Microsoft has not disclosed the vulnerable Word function, the memory layout, the overwrite offset, or a working exploit.

What the advisory does make clear is the code path that reaches the overflow. According to Microsoft's FAQ, the vulnerable path is hit when a user records a macro and applies a style that comes from a crafted document. That points to attacker-controlled style data being processed during macro recording, although the precise mechanics remain undisclosed.

The vulnerability was credited to Jeongmin Choi (@lmksecurity).

Attack flow

Based on Microsoft's published scenario, exploitation proceeds as follows:

1. The attacker prepares a specially crafted Word document that supplies a malicious style.
2. The attacker delivers the document to the target. CVSS classifies this as a network attack vector, and the attacker needs no account or privileges on the target system.
3. The attacker persuades the recipient to open the document in Word.
4. The recipient starts recording a macro.
5. While recording, the recipient applies the style supplied by the crafted document.
6. The stack-based overflow is triggered, and attacker code runs with the permissions of that user.

When assessing exposure, keep these points straight:

• The Preview Pane is not an attack vector. Microsoft states this explicitly, so Preview Pane claims from other Office bugs should not be carried over to this CVE.
• Macro recording is part of the required interaction, not the payload. The FAQ does not describe running an attacker-supplied macro as the exploit mechanism, so this is not a generic malicious macro scenario.
• Opening the document alone is not described as sufficient. Base exposure assessments on the full documented sequence.
• Impact is bounded by the user's rights. PR:N means the attacker needs no privileges to start. It does not mean exploitation yields administrator access, and Microsoft limits the impact statement to the user's permissions.

CVSS breakdown

Microsoft publishes the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• AV:N (Network): classified as a network attack. The FAQ describes delivery of a crafted document.
• AC:L (Low): Microsoft assigns low attack complexity.
• PR:N (None): no attacker privileges required on the target.
• UI:R (Required): user action is necessary before exploitation.
• S:U (Unchanged): scope is unchanged.
• C:H / I:H / A:H: high impact to confidentiality, integrity, and availability.
• E:U (Unproven): per Microsoft's definition, no public exploit code is available, or exploitation is theoretical.
• RL:O (Official Fix): a complete vendor solution is available.
• RC:C (Confirmed): the vulnerability is confirmed.

The base score is 8.8 and the temporal score is 7.7. NVD reproduces Microsoft's 8.8 High CNA score but notes that its own assessment has not yet been provided and the record is awaiting enrichment. The two sources do not disagree on severity. NVD has simply not finished enriching the record.

Exploitation status

At original publication, Microsoft's advisory reported "Exploited: No", "Publicly disclosed: No", and "Exploitation Less Likely". The advisory associates no threat actor, campaign, malware family, or indicators of compromise with the CVE.

CISA's November 10, 2026 announcement added six vulnerabilities to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation. CVE-2026-109505 is not among them. A secondary tracker (isMalicious) also reports the CVE as not listed in KEV, though we could not independently confirm full catalog absence from the CISA page.

CVSS 8.8 and Exploitation Less Likely answer different questions. The score describes what a successful attack achieves and under what conditions. The exploitability assessment describes expected exploitation. Neither cancels out the other, and neither changes the fact that a fix is available.

Patch information

Microsoft fixed CVE-2026-109505 in its November 10, 2026 Patch Tuesday release. The MSRC advisory (revision 1.0, published the same day) sets the CVSS temporal Remediation Level to Official Fix, defined as "A complete vendor solution is available," which is why the score drops from 8.8 base to 7.7 temporal. BleepingComputer's November 2026 Patch Tuesday table also lists the CVE as an Important-rated Word remote code execution bug.

How the fix ships

Word is closed source, so there is no public source diff or commit. Modern Office uses Click to Run, which means the fix arrives as a whole new build rather than a standalone hotfix for this CVE. Your build number tells you whether you have the fix. In the MSRC update table, the Microsoft 365 Apps rows point to the shared Office security release notes, with the build column linking to https://aka.ms/OfficeSecurityReleases instead of a single number. On Microsoft's November 10, 2026 security release notes, CVE-2026-109505 appears under the Word section.

First fixed builds

• Microsoft 365 Apps, Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: 2610 (20527.20194), 2609 (20430.20264), 2608 (20326.20320)
• Semi Annual Enterprise Channel: 2610 (20527.20192), 2609 (20430.20262), 2608 (20326.20318)
• Office 2024 and Office 2021 Retail: Version 2610 (Build 20527.20196)
• Office LTSC 2024 (32 bit and 64 bit): Version 2408, 16.0.17932.21140
• Office LTSC 2021 (32 bit and 64 bit): Version 2108, 16.0.14334.21048
• Office 365 for Mac, Office LTSC for Mac 2021 and 2024: 16.115 (Build 26110837)

NVD's affected version data from Microsoft matches these builds. The Office for Mac release notes list Version 16.115 (Build 26110837), dated November 10, 2026, as the newest release, with this CVE under its Word heading.

What changed between builds

The step from the previous monthly release is small. On October 13, 2026, LTSC 2021 was at Build 14334.20974 and LTSC 2024 was at 17932.21056. The November fix moves them to 14334.21048 and 17932.21140. Any machine still on October or earlier servicing builds is vulnerable.

What the code fix probably does (our inference, not vendor confirmed)

Given the CWE 121 classification and the documented trigger (applying a style from a crafted document while recording a macro), fixes for this bug class usually do one or more of the following:

• check the length of attacker-controlled data (here, probably style data) before copying it into a fixed-size stack buffer
• move that buffer to the heap with an allocation sized to fit
• reject malformed input before it reaches the copy

Microsoft has not said which approach it used. Treat this as background on how the bug class is typically fixed, not a description of the actual change.

Applying and confirming the update

Windows: open an Office app such as Word, create a new document, and select File > Account > Update Options > Update Now (select Enable Updates first if needed). If Update Options is missing, the install may be volume licensed or managed through Group Policy.

Mac: open Word or Excel and select Help > Check for Updates. In Microsoft AutoUpdate, select Update or Update All, then restart the app.

Managed Windows deployments: Microsoft documents the Office Deployment Tool and Group Policy for organizational update control. Office can download updates in the background and apply them when applications close, so a downloaded update is not the same as an installed one.

Verification: open Word's About dialog (Windows: File > Account > About Word; Mac: Word > About Word) and confirm the version and build are at or above the matching entry above. For Microsoft 365 channels, match both the version line (2608, 2609, or 2610) and the build number, because each channel receives its own fixed build.

Microsoft provides no CVE-specific workaround. The advisory does not present macro blocking, Preview Pane changes, or other configuration tweaks as a substitute for the update.

Affected systems and versions

NVD and the Microsoft-supplied CVE record publish the following affected ranges (the upper bound is excluded from the affected range):

• Microsoft 365 Apps for Enterprise: from 16.0.1. The upper boundary refers to Microsoft's Office security releases, so use the fixed build for your channel listed above.
• Microsoft Office 365 for Mac: from 1.0.0, before 16.115.26110837
• Microsoft Office LTSC 2021: from 16.0.1, before 16.0.14334.21048
• Microsoft Office LTSC 2024: from 16.0.0, before 16.0.17932.21140
• Microsoft Office LTSC for Mac 2021: from 16.0.1, before 16.115.26110837
• Microsoft Office LTSC for Mac 2024: from 16.0.0, before 16.115.26110837

These boundaries are product-specific, so do not apply a build number from one Office family to another. Subscription channel builds (for example Current Channel Version 2610, Build 20527.20196) and perpetual LTSC builds require separate checks.

One documentation note for Mac fleets: at the time the briefing material was reviewed, the Office for Mac update history page still showed November 4, 2026, Version 16.114.4 as its newest entry, while the Office for Mac release notes list 16.115 (Build 26110837) dated November 10, 2026. Version 16.114.4 is below the stated boundary and should not be treated as fixed.

Vendor security history

Microsoft is both the affected vendor and the assigning CNA. The European Commission, in its September 12, 2025 Teams commitments announcement, stated it had preliminarily found Microsoft dominant in the worldwide market for SaaS productivity applications for professional use. That is a qualified finding, not a Word-specific market share figure, but it illustrates how broadly Office flaws can reach.

The Cyber Safety Review Board's March 20, 2024 report on the 2023 Exchange Online intrusion found that Storm-0558 compromised mailboxes belonging to 22 organizations and over 500 individuals using authentication tokens signed with a Microsoft key created in 2016. The Board concluded the intrusion resulted from a cascade of Microsoft security failures and called for fundamental security reforms. That was an identity and cloud incident with no established link to this Word CVE.

Microsoft's July 2026 Secure Future Initiative progress report describes corrective activity: 99.97% user and device coverage for phishing-resistant MFA enforcement, decommissioning of 1.4M unused Entra applications, remediation of more than 550,000 critical- and high-risk open-source vulnerability instances, automated container patching of about 3M vulnerability instances each month, and publication of 1,989 CVEs with CWE and CPE annotations. These are company-reported program metrics. They neither establish nor rule out the exploitability of this particular defect.

References

• NVD: CVE-2026-109505
• CVE Record: CVE-2026-109505
• Microsoft Security Update Guide: CVE-2026-109505, Microsoft Office Word Remote Code Execution Vulnerability
• Release notes for Microsoft Office security updates (Microsoft Learn)
• Release notes for Office for Mac (Microsoft Learn)
• Update history for Office for Mac (Microsoft Learn)
• Update history for Office LTSC 2024 and Office 2024 (Microsoft Learn)
• BleepingComputer: Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero day
• Zero Day Initiative: The November 2026 Security Update Review
• MITRE CWE 121: Stack based Buffer Overflow
• How to update Microsoft 365 or Office for Windows (Microsoft Support)
• Update Microsoft 365 or Office on your macOS or iOS device (Microsoft Support)
• Keep Office apps up to date with the latest updates (Microsoft Learn)
• CISA Adds Six Known Exploited Vulnerabilities to Catalog (November 10, 2026)
• CISA Known Exploited Vulnerabilities Catalog
• isMalicious: CVE-2026-109505
• Cyber Safety Review Board: Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft Secure Future Initiative Progress Report, July 2026
• European Commission: Commission accepts commitments offered by Microsoft to address competition concerns related to Teams