Introduction
A crafted document, opened by a user in an unpatched copy of Microsoft Word, is enough to trigger remote code execution through CVE-2026-110047, a use-after-free flaw that Microsoft fixed on November 10, 2026. The bug spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and three Office for Mac products. Each of those families reaches its fixed state through a different build number, so most of the practical work for defenders lies in matching the correct build to the correct installation.
Key facts at a glance:
- Weakness: use after free (CWE 416) in Microsoft Office Word
- CVSS 3.1 base score: 8.8 (HIGH), scored by Microsoft as CNA, with a temporal score of 7.7
- Microsoft maximum severity: Critical
- User interaction: required. The victim must open an attacker-supplied file.
- Preview Pane: explicitly not an attack vector
- Exploitation status at original publication: not publicly disclosed, not exploited, rated Exploitation Less Likely
- Fix: Official Fix, delivered as new Office builds
Technical information
Root cause
Microsoft's advisory describes the issue in one line: "Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network." Word is closed source, and neither the advisory nor the ZDI November 2026 review identifies the vulnerable function, the object type involved, the file format, or the allocation sequence. What we can say about the root cause therefore comes from the weakness class itself, not from a reconstruction of Word's internal code path.
MITRE defines CWE 416 as referencing memory after it has been freed. Once an object is released, its memory can be reallocated to a different object while an older, dangling pointer still refers to the same address. Operations performed through that stale pointer then act on memory that now belongs to something else. MITRE lists possible consequences including corruption of valid data, crashes, information disclosure, and, under suitable conditions, arbitrary code execution. For this CVE, Microsoft confirms remote code execution as the impact but has not described the memory manipulation that makes it possible.
MITRE also documents engineering measures for this weakness class: automatic memory management through language choice, setting freed pointers to NULL (with the caveat that complex data structures reduce its usefulness and a NULL dereference may still crash), and compiler-integrated checking such as AddressSanitizer. These are development practices. An Office administrator cannot apply them to repair an installed Word binary.
There is no public source, diff, or patch note for this change, so we have no vulnerable code to show.
CVSS breakdown
The base vector published by Microsoft and reproduced by NVD:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Microsoft's fuller vector appends temporal metrics:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Reading the metrics individually:
- Attack Vector: Network. This coexists with a required user action. It does not describe an unattended network service attack.
- Attack Complexity: Low.
- Privileges Required: None. The attacker needs no prior access.
- User Interaction: Required. The user must open the crafted file.
- Scope: Unchanged.
- Confidentiality, Integrity, Availability: High for all three.
- Temporal factors: Exploit Code Maturity Unproven (
E:U), Remediation Level Official Fix (RL:O), Report Confidence Confirmed (RC:C). These bring the temporal score from 8.8 to 7.7. They describe exploit maturity, fix availability, and confidence, not observed attacks.
Two labeling details are worth carrying into internal communications. First, 8.8 HIGH is the CVSS classification, while Critical is Microsoft's own maximum severity rating. They come from different systems, and both are accurate. Second, NVD's own assessment was still awaiting enrichment, so 8.8 is Microsoft's CNA score rather than an independently completed NIST assessment.
Attack flow
Based on what Microsoft has disclosed, the documented attack scenario is:
- The attacker prepares a specially crafted file intended to trigger the use-after-free condition in Word.
- The attacker gets that file to a target user. Microsoft does not name a delivery channel, and no campaign has been documented.
- The user opens the file in Word. Microsoft states the Preview Pane is not an attack vector, so opening the file, not previewing it, is the documented trigger.
- While Word processes the file, a freed object is referenced through a stale pointer.
- Successful exploitation results in remote code execution, with high confidentiality, integrity, and availability impact as scored.
The advisory does not disclose a file extension or parser routine, and neither the score nor the description establishes further privilege escalation or full system compromise in every successful case. Anything more specific than the steps above would go past the public record.
Exploitation status
Microsoft's exploitability table, explicitly qualified as of original publication, reads: Publicly disclosed: No; Exploited: No; Exploitation Less Likely. The secondary source isMalicious likewise reports that active exploitation has not been confirmed, lists the CVE as not present in CISA's Known Exploited Vulnerabilities catalog, and lists no Nuclei template, Exploit DB entry, or Metasploit module. It supplies no EPSS score and no threat actor attribution.
None of this proves that undetected exploitation cannot occur. The defensible reading is narrower: Microsoft did not report known exploitation at original publication, and no campaign, malware family, or indicators of compromise have been tied to this CVE. CISA describes the KEV catalog as an authoritative source of vulnerabilities exploited in the wild and recommends it as an input to vulnerability management, which makes it a reasonable place to watch for a change in status.
Patch information
Microsoft fixed CVE-2026-110047 in its November 10, 2026 Patch Tuesday release. The MSRC Security Update Guide sets Remediation Level to Official Fix (RL:O), meaning a complete vendor update is available. That metric is why the temporal score drops from 8.8 to 7.7. The CVE record Microsoft published as CNA tags the MSRC advisory as both a vendor advisory and a patch reference, and NVD links to the same page.
What the fix is, and what it is not
Because Word is closed source, there is no public commit or diff, and neither the advisory nor the ZDI November review explains what was changed. In general terms, a use-after-free fix ensures an object cannot be reached through a dangling pointer once it has been freed. Typical approaches are:
- fixing reference counting or ownership so the object outlives every user of it,
- clearing the pointer after the free,
- adding checks that refuse to act on an object that has already been released.
Microsoft has not said which of these it used. What is public is that the fix ships as new Office builds, so patch state is determined by build number, and there is no separate hotfix to look for. The advisory material reviewed discloses no registry change, file blocking rule, or other interim workaround.
Fixed builds by product
All released November 10, 2026:
- Microsoft Office LTSC 2021 (32 bit and 64 bit):
16.0.14334.21048, documented in the Microsoft 365 Apps security updates release notes - Microsoft Office LTSC 2024 (32 bit and 64 bit):
16.0.17932.21140, documented in the Microsoft 365 Apps security updates release notes - Microsoft Office 365 for Mac:
16.115.26110837, documented in the Office for Mac release notes - Microsoft Office LTSC for Mac 2021:
16.115.26110837, documented in the Office for Mac release notes - Microsoft Office LTSC for Mac 2024:
16.115.26110837, documented in the Office for Mac release notes - Microsoft 365 Apps for Enterprise (32 bit and 64 bit): channel specific, and Microsoft refers to aka.ms/OfficeSecurityReleases
The MSRC table has nine rows because each Windows product is listed separately for 32 bit and 64 bit. For every vulnerable range, the CVE record's upper bound (versionEndExcluding / lessThan) is exactly the fixed build above, so any build at or above that number contains the fix.
How the fix is delivered
- Click to Run Office (Microsoft 365 Apps, Office LTSC 2021 and 2024): no standalone MSI-style KB package is listed. The fix comes in the November servicing build for each update channel and installs through the normal Office update path. Because Microsoft 365 Apps has several channels (Current, Monthly Enterprise, Semi Annual), each with its own build, Microsoft gives the release notes URL instead of one version number.
- Office for Mac: a single build,
16.115.26110837, fixes all three Mac SKUs and is delivered through Microsoft AutoUpdate.
Microsoft's supported manual update paths:
- Windows: open Word, create a new document, then select File > Account > Update Options > Update Now, selecting Enable Updates first if necessary. If Update Options is missing, the installation may be volume licensed or managed through Group Policy. Microsoft's guidance is to use Microsoft Update or contact the company help desk.
- Mac, installed from Microsoft: open Word, select Help > Check for Updates, then Update. Microsoft also documents the Automatically keep Microsoft apps up to date option.
- Mac, installed from the Mac App Store: use App Store > Updates, then Update All or the individual app's Update control.
A quirk worth knowing if you use automated scanners
In the official CVE JSON, the Microsoft 365 Apps for Enterprise entry puts a URL where the version bound should be:
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "16.0.1", "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases"
Scanners that compare versions mechanically cannot evaluate this bound. As a result, they may flag every Microsoft 365 Apps install as vulnerable, or miss it entirely. For that product, check the installed build against the November 2026 build for its channel in Microsoft's release notes, not just against the CVE record. The LTSC and Mac entries have real numeric bounds and can be checked automatically.
Affected systems and versions
From the Microsoft-supplied CVE record, with corresponding entries in NVD:
- Microsoft 365 Apps for Enterprise (32 bit and x64): from 16.0.1, before the channel-specific release identified through Microsoft's security releases reference
- Microsoft Office LTSC 2021 (32 bit and x64): from 16.0.1, before 16.0.14334.21048
- Microsoft Office LTSC 2024 (32 bit and x64): from 16.0.0, before 16.0.17932.21140
- Microsoft Office 365 for Mac: from 1.0.0, before 16.115.26110837
- Microsoft Office LTSC for Mac 2021: from 16.0.1, before 16.115.26110837
- Microsoft Office LTSC for Mac 2024: from 16.0.0, before 16.115.26110837
A few points matter for inventory work:
- LTSC 2021 and LTSC 2024 have different fixed boundaries, so one build target cannot represent both.
- The three Mac products share one boundary, but a shared version does not imply a single delivery path (AutoUpdate versus Mac App Store).
- Microsoft 365 Apps uses a release reference rather than a universal numeric cutoff.
- Microsoft's November security release notes list multiple Office products and builds, but that shared listing alone does not establish that every listed Office edition is affected by this CVE.
The vulnerable configuration is any installation in the ranges above where a user opens an attacker-supplied file in Word. The Preview Pane is not an attack vector.
Vendor security history
Microsoft is both the affected vendor and the assigning CNA, and it credits Ghirmay Desta in the acknowledgements for reporting the issue through coordinated vulnerability disclosure. Microsoft's 2026 annual report positions Microsoft 365 Commercial as an integrated business productivity platform combining Office with Windows, mobility, security, and other services.
The most substantive independent assessment of Microsoft's security record in our sources is the Cyber Safety Review Board's review of the summer 2023 Exchange Online intrusion. Microsoft determined that the attributed actor used an acquired consumer token-signing key to forge tokens and access Exchange Online accounts for 22 enterprise organizations and 503 related personal accounts, with victims including government agencies and three think tanks. The board concluded the intrusion was preventable and that Microsoft's security culture was inadequate, and found that allowing consumer keys to authenticate access to enterprise customer data expanded the intrusion's scope, including the State and Commerce Departments. That case concerns identity and cloud email security. Nothing in the Word advisory connects that actor to CVE-2026-110047.
Microsoft accepted responsibility for the findings, said it was acting on 16 applicable recommendations, and framed its Secure Future Initiative around Secure by Design, Secure by Default, and Secure Operations. It also tied one third of senior leadership individual performance bonuses to cybersecurity performance. The July 2026 SFI progress report states:
- 99.97% phishing-resistant MFA coverage for users and devices
- 1.4M unused Entra applications decommissioned
- 98.7% cross-boundary credential isolation
- public access removed from 732,000 resources
- more than 550,000 critical and high-risk open-source vulnerability instances remediated, with automated container patching addressing about 3M instances monthly
- more than 100 new detections and 1,989 CVEs published with CWE and CPE annotations
These are Microsoft's reported program outcomes, not evidence that this particular Word flaw was prevented or independently audited. For patching decisions, the product boundaries and fixed builds above are what matter.
References
- NVD: CVE-2026-110047
- CVE Record: CVE-2026-110047
- CVE JSON record for CVE-2026-110047 (CVEProject cvelistV5)
- Microsoft Security Update Guide: CVE-2026-110047, Microsoft Office Word Remote Code Execution Vulnerability
- Zero Day Initiative: The November 2026 Security Update Review
- Microsoft Office Security Releases
- Release notes for Microsoft Office security updates (Microsoft Learn)
- Update history for Office for Mac (Microsoft Learn)
- How to update Microsoft 365 or Office for Windows (Microsoft Support)
- Update Office for Mac automatically (Microsoft Support)
- MITRE CWE 416: Use After Free
- isMalicious: CVE-2026-110047
- CISA Known Exploited Vulnerabilities Catalog
- CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft On the Issues: Microsoft's work to strengthen cybersecurity protection
- SFI Progress Report July 2026 (Microsoft Trust Center)
- Microsoft 2026 Annual Report
