Introduction
Microsoft's November 2026 Patch Tuesday release fixed a heap-based buffer overflow in Word that can lead to code execution when a user opens a specially crafted PDF and accepts Word's conversion prompt. Word ships across Microsoft 365 Apps, Office LTSC, and Office for Mac, so for most teams the practical question is which build each endpoint is running.
Key facts at a glance:
- CVE: CVE-2026-110054, titled Microsoft Office Word Remote Code Execution Vulnerability
- Weakness: CWE-122, heap-based buffer overflow
- Severity: CVSS 3.1 base score 8.8 (High), temporal score 7.7
- Published: November 10, 2026, with Microsoft as the CNA
- Trigger: opening a specially crafted PDF in Word and accepting the conversion prompt
- Exploitation status: none reported by the third-party tracker we reviewed, and not confirmed either way
Technical information
Root cause
The vulnerability is a heap-based buffer overflow (CWE-122) in Microsoft Office Word. Microsoft's FAQ for this CVE states that the vulnerable code runs when a user opens a specially crafted PDF in Word and accepts the conversion prompt. That places the bug in Word's PDF-to-Word conversion path, not in normal .docx parsing. Microsoft also states that the Preview Pane is not an attack vector.
Word is closed source, so there is no public diff or commit to examine. Microsoft ships the fix inside updated Office binaries and does not identify which function or bounds check changed. In general, a fix for this class of bug makes the parser check length or count fields taken from the untrusted file against the size of the heap buffer it allocated, before copying any data into it. For this CVE, that general description is the limit of what can be said with confidence about the code change. We have no vulnerable code snippet to show.
Scoring
The CVSS 3.1 vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Reading the vector:
- AV:N / AC:L / PR:N: network attack vector, low attack complexity, no attacker privileges required
- UI:R: user interaction is required. Per Microsoft's FAQ, the user must open the crafted PDF in Word and accept the conversion prompt
- S:U / C:H / I:H / A:H: unchanged scope with high confidentiality, integrity, and availability impact
- E:U / RL:O / RC:C: exploit code maturity unproven, an official fix is available, and the report is confirmed. These temporal metrics bring the 8.8 base score down to a temporal score of 7.7
The 8.8 rating reflects potential impact, not evidence that exploitation has occurred.
Attack flow
Based on Microsoft's description, the attack sequence looks like this:
- The attacker prepares a specially crafted PDF designed to reach the vulnerable conversion code. Microsoft does not describe the malformed structure, and the materials do not specify a delivery method beyond what the network attack vector implies.
- The target opens that PDF in Word.
- Word displays its PDF conversion prompt, and the user accepts it.
- During conversion, Word processes attacker-controlled data and overflows a heap buffer.
- Successful exploitation can result in code execution, with the high confidentiality, integrity, and availability impact reflected in the CVSS vector.
Two details narrow the exposure. Previewing the file in the Preview Pane does not trigger the bug. And according to Microsoft's description, a user who declines the conversion prompt never reaches the vulnerable path.
What remains unknown
The public material does not identify the vulnerable function, the specific PDF structures involved, the heap layout conditions needed for reliable exploitation, or any exploit primitive. We are not aware of a verified proof of concept, and we have not attempted to reconstruct one.
Exploitation status
A third-party CVE tracker reports that no exploitation has been reported, that the record was awaiting NVD analysis, that no public exploit code or named threat actors are identified, and that the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. The CVSS temporal metric E:U is consistent with that. These statements come from a tracker and from scoring metadata, so active exploitation and attribution remain unconfirmed, not ruled out.
Patch information
Microsoft fixed CVE-2026-110054 in its November 2026 Patch Tuesday release, published November 10, 2026. The MSRC advisory lists a Remediation Level of Official Fix. MSRC's affected product API lists all nine affected SKUs with productStatus: "fixed" and customerActionRequired: true, which means the update must be installed for the fix to take effect.
Fixed builds by product
- Office LTSC 2021 (32 bit and 64 bit):
16.0.14334.21048(Version 2108) - Office LTSC 2024 (32 bit and 64 bit):
16.0.17932.21140(Version 2408) - Office 365 for Mac, Office LTSC for Mac 2021, Office LTSC for Mac 2024:
16.115.26110837 - Microsoft 365 Apps for Enterprise (32 bit and 64 bit): MSRC does not give a single build number and points to
https://aka.ms/OfficeSecurityReleases, because the fixed build depends on the update channel
Fixed builds by Click to Run channel
Microsoft's Release notes for Microsoft Office security updates lists CVE-2026-110054 under the Word heading for the November 10, 2026 release, with these builds:
- Current Channel: Version 2610 (Build 20527.20196)
- Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
- Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
- Office 2024 / Office 2021 Retail: Version 2610 (Build 20527.20196)
- Office LTSC 2024 Volume Licensed: Version 2408 (Build 17932.21140)
- Office LTSC 2021 Volume Licensed: Version 2108 (Build 14334.21048)
The Release notes for Office for Mac for the same day list CVE-2026-110054 among the security fixes in the 16.115 release (build 26110837).
Delivery and verification
The update arrives through normal Office servicing: Click to Run on Windows, and Microsoft AutoUpdate or the release notes download on macOS. There is no standalone hotfix for this CVE.
To confirm a machine is patched, check the installed version and build:
- Windows: File > Account > About Word
- Mac: Word > About Word
Compare the result with the lists above. On Windows, use the build that matches the machine's update channel. The build suffix is what proves the fix is installed. For example, an LTSC 2021 machine on 14334.20xxx is still vulnerable, while one on 14334.21048 or later is patched.
The materials we reviewed do not identify a separate workaround for this CVE.
Affected systems and versions
Combining the CVE record and MSRC's affected product data:
- Microsoft 365 Apps for Enterprise (32 bit and x64): affected from version 16.0.1. The upper bound is defined per update channel through Microsoft's Office security releases reference, not as a single numeric version
- Microsoft Office LTSC 2021 (32 bit and 64 bit): affected before
16.0.14334.21048(Version 2108). The CVE record excerpt itself did not include a version boundary, so this comes from MSRC's fixed-build data - Microsoft Office LTSC 2024 (32 bit and x64): affected from version 16.0.0 and before
16.0.17932.21140 - Microsoft Office 365 for Mac: affected from version 1.0.0 and before
16.115.26110837 - Office LTSC for Mac 2021 and Office LTSC for Mac 2024: listed by MSRC with fixed build
16.115.26110837
The vulnerable configuration is any unpatched build of these products where a user can open a PDF in Word and accept the conversion prompt. The product name alone is not enough to decide remediation status. Check the installed build against the channel-specific fixed build.
Vendor security history
The briefing materials include some broader context on Microsoft's security track record. None of it concerns this CVE directly.
- In its 2024 review of the Summer 2023 Microsoft Exchange Online intrusion, the US Cyber Safety Review Board concluded the incident was preventable and that Microsoft's security culture was inadequate, citing operational and strategic decisions that indicated security investment and risk management had been deprioritized. Those findings relate to Exchange Online, not to this Word flaw.
- Microsoft's July 2026 Secure Future Initiative progress report describes work on security culture, governance, and engineering. It reports 99.97 percent user and device coverage for phishing-resistant MFA and more than 550,000 remediated instances of critical and high-risk open-source vulnerabilities. These are company-reported program metrics, not independent validation of this fix.
References
- NVD: CVE-2026-110054
- CVE Record: CVE-2026-110054
- MSRC Security Update Guide: CVE-2026-110054
- MSRC affected product API for CVE-2026-110054
- Release notes for Microsoft Office security updates (Microsoft Learn)
- Release notes for Office for Mac (Microsoft Learn)
- isMalicious: CVE-2026-110054
- Google Workspace vs. Microsoft 365 (comparative study)
- CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft SFI Progress Report, July 2026
