Quick look: CVE-2026-110053, a heap-based buffer overflow in Microsoft Office Word

Introduction

Microsoft's November 10, 2026 Patch Tuesday release includes a fix for a heap-based buffer overflow in Microsoft Office Word that Microsoft says could allow an unauthorized attacker to execute code. Because the delivery mechanism is a malicious Office file that a user has to open, the practical question for most organizations is how quickly the fixed Word builds reach every endpoint, rather than whether a specific attack is already underway.

Microsoft rates CVE-2026-110053 as Important, with a CVSS 3.1 base score of 7.5 and a temporal score of 6.5. At initial publication, Microsoft reported no public disclosure and no exploitation, and rated exploitation Less Likely. The advisory also contains a scoring inconsistency around the attack vector that you should understand before you triage it.

Technical information

Root cause

Microsoft classifies the flaw as CWE-122, a heap-based buffer overflow, which MITRE describes as a product writing past the end of a buffer allocated on the heap. The bug lives in Word's document handling.

Word is closed source, and Microsoft has published no diff, commit, or root-cause writeup. The public material we reviewed does not identify the specific code path, the faulty operation, or the exact conditions that cause the overwrite. The usual fix for this class of bug is to check a length or size taken from the file against the real size of the heap buffer before copying data into it. Treat that as a general description of how these bugs get fixed, not a confirmed account of Microsoft's change.

Scoring

The MSRC CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H:

The NVD record is marked Awaiting Enrichment. It shows the Microsoft CNA score of 7.5, and NIST has not provided its own assessment. Every score in this post is Microsoft's.

The attack vector inconsistency

The advisory's vector says AV:N. Its FAQ, however, addresses the attack vector as local (AV:L), explaining that the word "remote" in the title refers to the attacker's location, while the attack itself is carried out locally once the malicious file is opened. We are not going to resolve that discrepancy by guesswork. For triage, the practical reading is the same either way: the attacker is remote, but code execution depends on a user opening a crafted file on the target system.

Attack flow

Based on Microsoft's FAQ, exploitation would proceed as follows:

1. The attacker prepares a malicious Office file intended to trigger the heap overflow in Word.
2. The attacker sends the file to a target user.
3. The user must open the file. Microsoft explicitly states that the Preview Pane is not an attack vector, so previewing the file is not the described path.
4. When Word processes the file, the out-of-bounds heap write occurs, and successful exploitation could result in code execution.

Microsoft notes that success is not guaranteed. Exploitation requires a deep understanding of the system and depends on factors such as the environment, configuration, and additional security measures in place, which is why attack complexity is rated high.

Exploitability status

At original publication, Microsoft's exploitability assessment was:

• Publicly disclosed: No
• Exploited: No
• Exploitation assessment: Less Likely
• Exploit code maturity: Unproven (no public exploit code, or a theoretical exploit)

No threat actor, campaign, malware family, or public proof of concept was identified in the sources we reviewed. The CISA KEV catalog content we reviewed did not show this CVE, though absence from an observed page is not conclusive. Microsoft credits Kentaro Kawane with GMO Cybersecurity by Ierae, Inc. for reporting the issue.

Patch information

Microsoft fixed CVE-2026-110053 in its November 10, 2026 Patch Tuesday release. The MSRC Security Update Guide sets the CVSS temporal Remediation Level to Official Fix, which Microsoft defines as "A complete vendor solution is available." In the MSRC affected product API, every one of the nine listed SKUs has productStatus: "fixed" and customerActionRequired: true, which means the fix protects you only once the update is installed. The advisory is at revision 1.0 ("Information published"), so Microsoft has not issued a revised version so far.

The patched Word binaries ship with the builds below, so for defenders the fix is effectively a version number.

Fixed builds by product

Click to Run channels

Microsoft 365 Apps does not have a single fixed build because each update channel ships its own build number. The Office security update release notes for the November 10, 2026 cycle list CVE-2026-110053, with channel builds including:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), and Version 2608 (Build 20326.20320)

The release notes also map volume-licensed LTSC 2024 to Version 2408 (Build 17932.21140) and LTSC 2021 to Version 2108 (Build 14334.21048), matching the MSRC table. Get Semi Annual Enterprise Channel builds directly from the release notes page, since those entries need checking against the source. The release notes list this CVE under the Access heading and do not explicitly map every listed build to this specific CVE, so anchor your checks on the product-specific fixed boundary from MSRC and a supported update channel.

Mac

On macOS the fix ships as Office build 16.115.26110837 through Microsoft AutoUpdate. MSRC links to the Office for Mac release notes for download and KB details.

Deploying and verifying

Per Microsoft's update guidance for Microsoft 365 Apps, Office checks for updates automatically by default. A manual check is available under File > Account > Update Options > Update Now, and managed Windows organizations can configure update settings with the Office Deployment Tool or Group Policy. The Office LTSC 2024 update guide describes automatic delivery from the Office CDN and the same manual check path, and notes that open Office apps may need to be closed for a downloaded update to install.

To confirm the patch on Windows, open File > Account > About Word and compare the build against the table above, or against your channel's build for Click to Run installs. Anything lower than the build listed for your product or channel is still vulnerable.

Microsoft provides no vulnerability-specific workaround. Because the Preview Pane is not an attack vector, disabling it is not a mitigation for this flaw.

Affected systems and versions

NVD's affected version data, supplied by Microsoft, matches the fixed builds above:

Windows SKUs for Microsoft 365 Apps, Office LTSC 2021, and Office LTSC 2024 are listed in both 32-bit and 64-bit variants, giving nine SKUs in total.

Vendor security history

This context is background, not evidence about this Word flaw. In its review of the Summer 2023 Microsoft Exchange Online intrusion, the Cyber Safety Review Board concluded that Microsoft's security culture was inadequate and that the intrusion should never have happened, describing a cascade of security failures and decisions that reflected deprioritized security investment and risk management. That incident involved Exchange Online, not CVE-2026-110053.

Microsoft's November 2025 Secure Future Initiative progress report describes subsequent reforms, including phishing-resistant MFA for 99.6 percent of employees and devices, and states that 5 of 28 objectives were nearing completion while 12 had made significant progress. These are Microsoft-reported measures and do not establish anything about the presence or prevention of this specific vulnerability.

References

• MSRC Security Update Guide: CVE-2026-110053
• MSRC affected product API for CVE-2026-110053
• NVD: CVE-2026-110053
• CVE Record: CVE-2026-110053
• Release notes for Microsoft Office security updates
• CWE-122: Heap based Buffer Overflow
• Keep Office apps up to date with the latest updates
• Update Office LTSC 2024
• How to update Microsoft 365 or Office for Windows
• CISA Known Exploited Vulnerabilities Catalog
• Zero Day Initiative: The November 2026 Security Update Review
• BleepingComputer: Microsoft November 2026 Patch Tuesday coverage
• isMalicious entry for CVE-2026-110053
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft SFI Progress Report, November 2025
• Microsoft 2026 Annual Report