Brief Summary: Microsoft Word CVE-2026-110048 Heap Buffer Overflow Leading to Remote Code Execution

Introduction

Microsoft's November 2026 Patch Tuesday release includes a fix for a memory corruption flaw in Microsoft Word that can turn a single opened document into code execution on the recipient's machine. Tracked as CVE-2026-110048, the issue carries a CVSS 3.1 base score of 8.8 and spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and three Office product lines on Mac.

The public records are easy to misread, so four points up front:

The vendor is Microsoft. The NVD feed lists the vendor as Unknown, but Microsoft is the CNA and publishes the advisory.
Two severity labels, one issue. NVD shows Microsoft's 8.8 base score as High. Microsoft's own maximum severity label is Important. These come from different rating systems and do not conflict.
User interaction is required. The attacker needs no privileges, but the victim must open a malicious Office file. The Preview Pane is explicitly not an attack vector.
No exploitation reported at publication. Microsoft recorded Exploited: No and Exploitation Less Likely.

Technical information

Root cause: a heap buffer overflow in Word

Microsoft describes the flaw as a heap-based buffer overflow in Microsoft Office Word that allows an unauthorized attacker to execute code over a network, and classifies it as CWE-122: Heap-based Buffer Overflow. The advisory lists the impact as remote code execution.

MITRE's definition of CWE-122 covers buffer overflows where the overwritten memory was allocated on the heap. In general terms, such corruption can crash the process or, in some circumstances, overwrite data such as function pointers and redirect execution to attacker-controlled code. That describes the weakness class in general, not this specific bug.

Microsoft has not published root-cause details. The advisory does not identify the vulnerable function, the parser or record type involved, the document structure that triggers the overflow, the size or nature of the overwrite, the heap layout, or any payload construction. So we cannot say from the public record which file extension is involved, whether macros play any role, or whether any exploit mitigation bypass is required. No vulnerable code is public, since Word is proprietary.

What "network" means in this advisory

The description says code can be executed "over a network", and the CVSS vector uses Attack Vector: Network. Microsoft's FAQ clarifies this: the word Remote refers to the attacker's location, while the attack itself is carried out locally on the victim's machine. Put that together with the file-opening requirement, and the documented scenario is remote delivery of a document followed by exploitation inside Word on the endpoint. There is no exposed Word network listener being attacked.

CVSS breakdown

The published base vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector: Network. Exploitation can originate across network boundaries.
Attack Complexity: Low. No specialized attack conditions are required.
Privileges Required: None. The attacker needs no prior authorization.
User Interaction: Required. A user must act (open the file) before exploitation.
Scope: Unchanged.
Confidentiality, Integrity, Availability: High. Potentially total loss of each.

In practice, needing no attacker privileges is not the same as needing no victim interaction.

Microsoft also publishes a temporal score of 7.7, which reflects exploit code maturity Unproven, remediation level Official Fix, and report confidence Confirmed. NVD displays Microsoft's CNA assessment and marks the record as Awaiting Enrichment, meaning NVD has not yet provided its own score.

Attack flow

Based on Microsoft's FAQ, the documented exploitation scenario is:

The attacker prepares a malicious Office file designed to trigger the heap overflow in Word. The internals of this file are not disclosed.
The attacker delivers the file to the target remotely. No account or privileges on the target system are needed.
The attacker persuades the recipient to open the file. Previewing it in the Preview Pane is not a documented attack vector.
When Word processes the file, the heap buffer overflow occurs on the recipient's machine.
Successful exploitation results in code execution, with high confidentiality, integrity and availability impact as scored by Microsoft.

This is the vendor's described scenario, not a reported incident.

Exploitation status

At original publication, Microsoft's assessment was:

Exploited: No
Publicly disclosed: No
Exploitability: Exploitation Less Likely
Exploit code maturity: Unproven (no public exploit code, or only a theoretical exploit)

The isMalicious aggregator likewise reports no confirmed exploitation, no CISA KEV listing, and no Nuclei template, Exploit DB entry or Metasploit module. The sources we reviewed identify no threat actor, campaign, victim organization, malicious document hash or CVE-specific EPSS value. They support a high potential impact. They do not support confirmed active exploitation. These assessments are point in time and do not rule out future exploitation.

Patch information

How it was fixed. Microsoft fixed CVE-2026-110048 in its November 10, 2026 Patch Tuesday release, publishing version 1.0 of the Security Update Guide entry that day. Word is closed source, so there is no public commit, diff or source snippet. The fix ships only as updated Office binaries. Microsoft sets the CVSS Remediation Level to Official Fix, meaning a complete vendor fix is available. That is what lowers the temporal score from 8.8 to 7.7.

What the fix addresses. The fix targets the CWE-122 heap overflow in Word described above. Fixes for this bug class usually add bounds or length checks before file-supplied data is copied into a heap buffer, but Microsoft has not confirmed how this particular patch works, and any statement about the exact code change would be speculation.

Fixed builds by product. These boundaries come from the MSRC Security Updates table and match the NVD affected products data. Installs older than these builds are vulnerable:

Microsoft Office 365 for Mac: 16.115.26110837
Microsoft Office LTSC for Mac 2021: 16.115.26110837
Microsoft Office LTSC for Mac 2024: 16.115.26110837
Microsoft Office LTSC 2021 (32-bit and 64-bit): 16.0.14334.21048
Microsoft Office LTSC 2024 (32-bit and 64-bit): 16.0.17932.21140
Microsoft 365 Apps for Enterprise (32-bit and 64-bit): no fixed build number is given. Microsoft points to its Office security releases channel.

The two LTSC generations have different fixed builds, so a build number for one is not valid for the other.

Where the update comes from.

Mac editions: all three Mac products share fixed build 16.115.26110837. The download and knowledge base links point to the Office for Mac release notes.
Windows Click to Run editions: Microsoft 365 Apps and Office LTSC 2021 and 2024 are updated through the Microsoft 365 Apps security updates release notes channel, not a standalone KB package.
Verification: compare the installed Office build against the list above.

Applying the update.

Windows: open Word, create a document, go to File > Account, then Update Options > Update Now under Product Information (select Enable Updates first if needed). If Update Options is missing, a volume license installation or Group Policy may control updates. In that case, Microsoft directs users to Microsoft Update or their help desk.
Mac (apps from Microsoft): open an Office app and choose Help > Check for Updates, then use Microsoft AutoUpdate (optionally enabling Automatically keep Microsoft apps up to date) and select Update.
Mac (apps from the Mac App Store): use the App Store Updates page and Update All or the individual app's Update button.
Managed Mac fleets: Microsoft documents downloading app update packages and deploying them with existing software deployment tools.

Workarounds. Microsoft supplies none. The published material does not establish any registry change, macro setting, firewall rule or Preview Pane change as a substitute for the update.

Documentation gap. At the time of review, the general Office security release notes page ended at October 13, 2026 and the Mac release notes ended at October 27, 2026, so those pages did not yet independently show the November entry for this CVE. Rely on the MSRC mappings above and do not substitute an older release for the listed fix.

Release context. BleepingComputer and CyberSecurityNews both list CVE-2026-110048 among the Word fixes in the November 2026 release, described as a "Microsoft Word Remote Code Execution Vulnerability" rated Important. There was no separate out-of-band fix. It ships in the regular monthly Office security update.

Affected systems and versions

Per the MSRC advisory and the CVE record, the following products are affected at builds earlier than the listed fixed build:

Microsoft Office 365 for Mac: builds earlier than 16.115.26110837
Microsoft Office LTSC for Mac 2021: builds earlier than 16.115.26110837
Microsoft Office LTSC for Mac 2024: builds earlier than 16.115.26110837
Microsoft Office LTSC 2021, 32-bit and 64-bit editions: builds earlier than 16.0.14334.21048
Microsoft Office LTSC 2024, 32-bit and 64-bit editions: builds earlier than 16.0.17932.21140
Microsoft 365 Apps for Enterprise, 32-bit and 64-bit systems: affected, but the advisory gives no numeric fixed build and refers to Microsoft's Office security release information.

The vulnerable configuration is any of the above where a user opens a malicious Office file in Word. Preview Pane rendering alone is not a documented trigger.

Vendor security history

The briefing materials do not reference prior Word CVEs, but they do cover Microsoft's broader security record.

Summer 2023 Exchange Online intrusion. The Cyber Safety Review Board found the intrusion was preventable and pointed to operational and strategic decisions indicating Microsoft had deprioritized enterprise security investment and rigorous risk management. DHS attributed it to an actor assessed as affiliated with the People's Republic of China. The Board recommended a public reform plan with timelines, stronger identity and credential controls, and minimum default audit logging at no extra charge. This incident concerned cloud identity and authentication and has no connection to CVE-2026-110048.
Secure Future Initiative, July 2026. Microsoft reports three objectives at target state, three nearing completion and twelve with significant progress, including 99.97% user and device coverage for phishing-resistant credential defaults and 93% of critical and high-value build pipelines on centrally governed templates. These are Microsoft's own measurements.

Neither source shows whether this specific Word defect was prevented, detected earlier or affected by those reforms. For this CVE, the operationally relevant evidence is the advisory, the affected product list and the fixed builds.

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical information