Brief Summary: Microsoft Word CVE-2026-110050 Heap-Based Buffer Overflow Enabling Remote Code Execution

Introduction

Microsoft's November 10, 2026 Patch Tuesday release fixed a heap-based buffer overflow in Microsoft Office Word that can lead to code execution when a user opens a specially crafted file. With a CVSS 3.1 base score of 8.8 and affected builds spanning Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and Office for Mac, CVE-2026-110050 reaches a large share of Windows and Mac document workflows, even though Microsoft reported no exploitation at publication.

This post summarizes what Microsoft, the CVE record, and NVD have published, which builds carry the fix, and where the public record stops.

Technical information

Root cause

Microsoft classifies the flaw as CWE-122, Heap-based Buffer Overflow. MITRE defines this weakness as writing beyond the end of a buffer allocated on the heap. Its generic consequences include crashes, memory modification, and arbitrary code execution. Overwriting function pointers is one possible mechanism MITRE describes. These describe the weakness class in general. They are not disclosed implementation details of this particular Word bug.

Word is closed source, so there is no public commit or diff to inspect. Microsoft has not identified the file format, the vulnerable parsing function, the malformed field, or the precise memory corruption sequence. As general background, heap overflows in document parsers are typically fixed by checking attacker-controlled lengths and counts against the size of the allocated buffer before copying data. Microsoft has not said whether that is what changed here.

The fix shipped alongside a large group of Word CVEs in the same release (CVE-2026-110046 through CVE-2026-110056, among others). That points to substantial hardening of Word's file parsing code this cycle, but Microsoft has not said which component or document structure the CVE-2026-110050 fix touches.

CVSS breakdown

Microsoft publishes the base vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H with a base score of 8.8 and a temporal score of 7.7. The temporal vector adds E:U/RL:O/RC:C: Unproven exploit maturity, Official Fix, and Confirmed report confidence.

• Attack Vector: Network. This rating does not remove the requirement that a user opens the file.
• Attack Complexity: Low. No specialized access conditions are required.
• Privileges Required: None. This describes the attacker's starting access. It does not mean successful exploitation yields administrator privileges. The advisory does not disclose the resulting execution privilege level.
• User Interaction: Required. A user must open the attacker's crafted file.
• Scope: Unchanged.
• Confidentiality, Integrity, Availability: High.

Microsoft's own severity rating is Important, while the CVSS rating is High. The two use different terminology and should not be conflated. NVD currently displays Microsoft's 8.8 CNA score. NIST's own assessment is not yet provided and the record awaits enrichment, so this is not an independently calculated NVD score.

Attack flow

Based on the advisory, the documented exploitation path looks like this:

1. The attacker constructs a specially crafted file designed to trigger the heap overflow. The file type and malformed structure are not disclosed.
2. The attacker gets the file to the target. CVSS rates the vector as Network, but the advisory does not describe a specific delivery channel.
3. The user opens the file in an affected Word build. This step is mandatory (UI:R). Microsoft explicitly states the Preview Pane is not an attack vector, so previewing alone is not a documented trigger. The advisory also does not establish any macro requirement.
4. While Word processes the file, data is written beyond the bounds of a heap-allocated buffer, corrupting adjacent heap memory.
5. Successful exploitation results in remote code execution with High confidentiality, integrity, and availability impact. The privilege context of the resulting code is not disclosed.

Exploitation status

Microsoft's exploitability assessment, which reflects the state at original publication, reports Publicly disclosed: No, Exploited: No, and Exploitation Less Likely. Exploit maturity is Unproven, meaning there is no publicly available exploit code, or the exploit is theoretical. The isMalicious entry also reports no confirmed exploitation and lists no Exploit DB entry, Metasploit module, or Nuclei template. No threat actor, campaign, or indicators are tied to this CVE, and the advisory acknowledgement lists Anonymous. CISA KEV inclusion is not established. None of this means exploitation is impossible. It means the reviewed sources show no evidence of an active campaign.

What remains undisclosed

• The affected file format or extension
• The vulnerable parser or function
• The specific memory corruption primitive
• The privilege level of resulting code execution
• Any exploit sample or forensic artifacts

Patch information

The temporal vector includes RL:O, meaning Official Fix: Microsoft states a complete vendor solution is available. Because the patch is delivered only as updated Office builds, the build number is the one reliable way to confirm a machine is fixed. On Windows, the update ships through Click to Run as a cumulative Office update. On Mac, it ships in Office for Mac 16.115.

Fixed builds by product

• Microsoft Office LTSC 2024 (32 bit and x64): vulnerable from 16.0.0 to before 16.0.17932.21140. First fixed build: 16.0.17932.21140.
• Microsoft Office LTSC 2021 (32 bit and x64): vulnerable from 16.0.1 to before 16.0.14334.21048. First fixed build: 16.0.14334.21048.
• Microsoft Office 365 for Mac: vulnerable before 16.115.26110837. First fixed build: 16.115 (Build 26110837).
• Office LTSC for Mac 2024 and 2021: vulnerable before 16.115.26110837. First fixed build: 16.115 (Build 26110837).
• Microsoft 365 Apps for Enterprise (32 bit and x64): vulnerable from 16.0.1 up to the November channel builds. See the channel list below.

Microsoft 365 Apps: fixed builds by update channel

Microsoft 365 Apps is serviced through several channels, so MSRC does not give a single build number. It points to the Office security release notes, which list CVE-2026-110050 under Word for the November 10, 2026 release:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)

Compare the build number portion (for example, 20527.20196). Several versions in each channel are serviced, and each has its own fixed build, so check a device against the build listed for its own version and channel rather than against the newest build.

Installing the update on Windows

Microsoft's published procedure: open an Office application such as Word and create a document, select File > Account, then select Update Options > Update Now under Product Information. If Update Now is unavailable, Enable Updates may need to be selected first.

Protected View and workarounds

Microsoft describes Protected View as a read-only mode with most editing functions disabled, intended to reduce risk from potentially unsafe files, and advises enabling editing only for trusted sources. That is general guidance. It is not established as a blocker for this CVE. No CVE-specific workaround is published, so disabling the Preview Pane or changing macro settings should not be treated as a remedy. The build update is the fix.

A note on discarded data

One automated upstream patch check associated this CVE with Eclipse Jetty versions 12.0.36 and 12.1.10. We found no evidence for that link. The Jetty data appears to belong to a different CVE and is unrelated to this Word fix.

Affected systems and versions

The CNA record lists six product families across Windows and Mac:

• Microsoft 365 Apps for Enterprise (32 bit and x64): from 16.0.1, before the fixed channel builds listed in the Office security release notes
• Microsoft Office LTSC 2021 (32 bit and x64): 16.0.1 through versions before 16.0.14334.21048
• Microsoft Office LTSC 2024 (32 bit and x64): 16.0.0 through versions before 16.0.17932.21140
• Microsoft Office 365 for Mac: 1.0.0 through versions before 16.115.26110837
• Microsoft Office LTSC for Mac 2021: 16.0.1 through versions before 16.115.26110837
• Microsoft Office LTSC for Mac 2024: 16.0.0 through versions before 16.115.26110837

The numeric endpoints are the first fixed builds, not affected versions. Whether a machine is exposed depends on its product family and servicing channel, not simply on whether Office is installed. The reviewed advisory and CNA material do not supply a specific KB identifier.

Vendor security history

Microsoft is the CNA for this CVE. Its productivity portfolio spans enterprise offerings such as Microsoft 365 Commercial as well as consumer subscriptions and licensed Office products.

For independent context on Microsoft's security record, the Cyber Safety Review Board's review of the 2023 Exchange Online intrusion found that Microsoft did not itself detect the compromise of its cryptographic assets and relied on a customer to identify anomalies. The Board concluded the intrusion was preventable and that Microsoft's security culture was inadequate and required an overhaul. That incident concerned cloud infrastructure and is not connected to this Word vulnerability.

Microsoft's July 2026 Secure Future Initiative report describes changes across culture, governance, and engineering, including Zero Trust principles. It reports three objectives at target state, three nearing completion, and twelve with significant progress. These are vendor-reported outcomes rather than an independent finding. For CVE-2026-110050 specifically, the product-level response is the published set of fixed builds.

References

• NVD entry for CVE-2026-110050
• CVE.org record for CVE-2026-110050
• Microsoft Security Update Guide: CVE-2026-110050
• Release notes for Microsoft Office security updates
• Release notes for Office for Mac
• Update history for Office for Mac
• MITRE CWE 122: Heap-based Buffer Overflow
• How to update Microsoft 365 or Office for Windows
• What is Protected View?
• Zero Day Initiative: The November 2026 Security Update Review
• GovCERT.HK Security Alert A26 11 02: Multiple Vulnerabilities in Microsoft Products
• isMalicious entry for CVE-2026-110050
• CISA Known Exploited Vulnerabilities Catalog
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft SFI Progress Report July 2026
• Microsoft 2026 Annual Report