Introduction
Microsoft's November 10, 2026 Patch Tuesday release fixed a heap-based buffer overflow in Microsoft Office Word that can lead to remote code execution when a user opens a specially crafted file. The affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and three Office for Mac products, so CVE-2026-110061 reaches deep into everyday document workflows, even though Microsoft reports no exploitation at publication.
This post summarizes what the public record establishes, what it leaves open, and which builds close the issue.
Technical Information
Root cause
Microsoft classifies the vulnerability as CWE 122, heap-based buffer overflow. MITRE defines this weakness as an overflow condition in which the buffer being overwritten was allocated in the heap portion of memory. The general consequences of the class include memory corruption and execution of unauthorized code, for example through overwritten function pointers. Those consequences describe the weakness class in general, not a published reconstruction of this particular Word bug.
The advisory does not name the affected function, the file format involved, or the malformed input structure that triggers the corruption. Word is closed source, so there is no public commit, diff, or patched function to study, and we are not reproducing any code here. Microsoft has not described the code change. Heap overflows of this kind are usually fixed by validating a length or size read from the document against the size of the destination heap buffer before copying data. That is a plausible description of the fix, but it is an educated guess, not a vendor statement.
Attack flow
The sequence Microsoft documents is short:
- The attacker prepares a specially crafted file and delivers it to the target.
- The victim opens that file in an affected version of Word.
- Processing the file triggers the heap overflow, and remote code execution can result.
The advisory also sets two boundaries. First, Microsoft explicitly states that the Preview Pane is not an attack vector, so Preview Pane exploitation claims from unrelated Office bugs do not apply. Second, the advisory does not establish a specific post-exploitation privilege level, a sandbox escape, or full operating system takeover. The published information does not support a more detailed exploit chain.
Reading the CVSS vector
The Microsoft-supplied CVSS v3.1 base vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack Vector: Network. Remote in the scoring model, but the FAQ still requires the victim to open a file. Read this alongside the FAQ, not as evidence of a network-reachable Word service.
- Attack Complexity: Low. No specialized access conditions are specified.
- Privileges Required: None. The attacker needs no prior authorized access.
- User Interaction: Required. A user must open the crafted file.
- Scope: Unchanged. Impact stays within the same security authority.
- Confidentiality, Integrity, Availability: High. Severe potential impact on all three. This models possible harm, not observed damage.
The base score is 8.8 (High). Microsoft's own product severity rating is Important. Microsoft also publishes a 7.7 temporal score, which accounts for Unproven exploit maturity, an Official Fix (RL:O), and Confirmed report confidence. The temporal score does not replace the base score.
Exploitation status
At original publication, Microsoft's assessment reads "Exploited: No," "Publicly disclosed: No," and "Exploitation Less Likely," with exploit code maturity "Unproven" (no publicly available exploit code, or an exploit that remains theoretical). The Zero Day Initiative assigns it an Exploitability Index of 2.
The CISA Coordinator SSVC entry embedded in NVD, timestamped 2026-11-10T20:41:09.794786Z, is consistent with this picture:
- Exploitation: none
- Automatable: no
- Technical Impact: total
No threat actor or campaign is tied to this CVE in the advisory or NVD record. The advisory credits an anonymous reporter, which is a disclosure acknowledgment, not attribution. No verified working exploit, sample hashes, command-and-control infrastructure, or CVE-specific signatures are available. In our reading, the high potential impact and the absence of reported exploitation are separate judgments, and neither cancels the other. "Exploited: No" is also a reported status, not proof that undiscovered exploitation is impossible.
Patch Information
Microsoft fixed CVE-2026-110061 in its November 10, 2026 Patch Tuesday release. The MSRC advisory sets the temporal Remediation Level to Official Fix (RL:O), meaning a complete vendor update exists. The fix ships as updated Office binaries through Microsoft's normal servicing channels.
Fixed builds from MSRC and NVD
- Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140
- Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048
- Microsoft 365 Apps for Enterprise (32 bit and 64 bit): build depends on the update channel (Microsoft points to aka.ms/OfficeSecurityReleases)
- Microsoft Office 365 for Mac: 16.115 (Build 26110837)
- Microsoft Office LTSC for Mac 2024: 16.115 (Build 26110837)
- Microsoft Office LTSC for Mac 2021: 16.115 (Build 26110837)
The Mac build is not interchangeable with the Windows LTSC thresholds, and Microsoft 365 Apps requires the channel-specific build rather than either LTSC number.
Microsoft 365 Apps channel builds
The November 10, 2026 entry in Microsoft's Release notes for Microsoft Office security updates lists CVE-2026-110061 with a build per channel:
- Current Channel: Version 2610 (Build 20527.20196)
- Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
- Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
- Office LTSC 2024 VL: Version 2408 (Build 17932.21140)
- Office LTSC 2021 VL: Version 2108 (Build 14334.21048)
The two volume-licensed LTSC entries match the MSRC thresholds above.
Mac
The Office for Mac release notes for Version 16.115 (Build 26110837), released November 10, 2026, list CVE-2026-110061 among roughly 60 Word security fixes in that build. Microsoft shipped this fix as part of one large Word update rather than a standalone hotfix, so any Mac at 16.115 or later has it.
Context within the November release
The Zero Day Initiative's November 2026 review and BleepingComputer's Patch Tuesday roundup both list CVE-2026-110061 as an Important-rated Word RCE with CVSS 8.8. It is one of about 65 Word CVEs fixed this month. A single cumulative Word update addresses all of them, so installing it for this CVE also fixes the rest of the batch. When confirming remediation, don't go by whether a particular KB was applied. Check the installed build number.
Applying the update
- Windows, user-managed: open Word, create a document, go to File > Account, and choose Update Options > Update Now. Select Enable Updates first if it is shown.
- Windows, centrally managed: if Update Options is missing and only About appears, the installation may use volume licensing or Group Policy. Microsoft's guidance is to try Microsoft Update or contact the help desk. Administrators can configure update behavior through the Office Deployment Tool or Group Policy.
- Mac: use Microsoft AutoUpdate via Help > Check for Updates in any Office app, or deploy the update packages with existing software deployment tooling.
Microsoft documents no workaround or alternative mitigation for this CVE. Nothing in the sources establishes that disabling macros, changing Preview Pane settings, or applying a registry setting addresses it. MITRE's general CWE 122 guidance (bounds checking, languages or compilers with automatic bounds checking) applies to developers and is not a substitute for the patch.
Affected Systems and Versions
NVD uses the same thresholds as MSRC:
- Microsoft Office LTSC 2024, 32 bit and 64 bit (Windows): affected from 16.0.0 up to, but not including, 16.0.17932.21140
- Microsoft Office LTSC 2021, 32 bit and 64 bit (Windows): builds below 16.0.14334.21048
- Microsoft 365 Apps for Enterprise, 32 bit and 64 bit (Windows): builds below the channel-specific fixed build listed in the Patch Information section
- Microsoft Office 365 for Mac: versions up to, but not including, 16.115.26110837
- Microsoft Office LTSC for Mac 2024: versions up to, but not including, 16.115.26110837
- Microsoft Office LTSC for Mac 2021: versions up to, but not including, 16.115.26110837
The vulnerable configuration is any of these builds being used to open an attacker-supplied file. The Preview Pane is not an attack vector.
Vendor Security History
Microsoft's reach in productivity software is substantial. The European Commission's June 2024 preliminary assessment found Microsoft dominant worldwide in SaaS productivity applications for professional use, and its later competition decision discusses Word, Excel, PowerPoint, and Outlook within Microsoft's suite distribution. That is context for exposure breadth, not a count of affected installations, and the preliminary assessment is not a final finding of infringement.
The most cited independent review of Microsoft's security practices is the Cyber Safety Review Board's report on the 2023 Exchange Online intrusion. A threat actor assessed as affiliated with the People's Republic of China compromised mailboxes belonging to 22 organizations and over 500 individuals, using authentication tokens signed with a Microsoft key created in 2016. The Board described operational and strategic decisions pointing to a culture that deprioritized enterprise security investment and rigorous risk management, criticized Microsoft's failure to detect the key compromise itself, and noted delays in correcting inaccurate public statements. That case concerns cloud identity, and nothing links it technically to this Word bug.
Microsoft's July 2026 Secure Future Initiative progress report describes subsequent changes across culture, governance, and engineering: three objectives at target state, three nearing completion, twelve with significant progress, and 99.97% phishing-resistant MFA coverage for users and devices. These are vendor-reported program outcomes. For CVE-2026-110061 specifically, the relevant vendor action is the advisory and the product-specific updates described above.
References
- MSRC Security Update Guide: CVE-2026-110061
- NVD: CVE-2026-110061
- CVE Record: CVE-2026-110061
- NVD API record for CVE-2026-110061
- Microsoft Learn: Release notes for Microsoft Office security updates
- Microsoft Learn: Release notes for Office for Mac
- Zero Day Initiative: The November 2026 Security Update Review
- BleepingComputer: Microsoft November 2026 Patch Tuesday roundup
- MITRE CWE 122: Heap Based Buffer Overflow
- Microsoft Support: How to update Microsoft 365 or Office for Windows
- Microsoft Learn: Keep Office apps up to date with the latest updates
- Cyber Safety Review Board: Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft Trust Center: SFI Progress Report July 2026
- European Commission: Statement of Objections to Microsoft regarding Teams
- European Commission: Cases AT.40721 and AT.40873, Microsoft Teams decision
- isMalicious: CVE-2026-110061 entry
