Introduction
Microsoft patched a heap buffer overflow in Microsoft Office Word in its November 2026 security release. The flaw can let an attacker run code on a system once a user opens a crafted Office document. The affected records cover Microsoft 365 Apps and Office LTSC editions on both Windows and Mac, so the practical work for defenders is confirming that every product line and update channel has reached its fixed build.
Technical information
Advisory at a glance
- Name: Microsoft Office Word Remote Code Execution Vulnerability
- Assigning authority: Microsoft. The input data lists the vendor as unknown, but NVD identifies Microsoft Corporation as the source.
- Published: 10 November 2026. The NVD publication timestamp is 19:18:24.120 UTC.
- Weakness: CWE-122, heap-based buffer overflow
- Microsoft severity: Important
- CVSS 3.1: base score 8.8 (High), temporal score 7.7
- Exploit maturity: Unproven
- Remediation level: Official Fix
- NVD status: Awaiting Enrichment. NVD has not supplied its own severity assessment, so the 8.8 score is Microsoft's.
Root cause
MITRE defines CWE-122 as writing past the end of a buffer allocated on the heap. In general, this class of bug can cause crashes. In some implementations it can also corrupt adjacent data such as function pointers, which may let an attacker redirect execution to their own code. These are properties of the weakness class and say nothing about the exact exploitation primitive in this Word bug.
Word is closed source, and Microsoft has published no diff, commit or root-cause write-up. The advisory does not name:
- the vulnerable parser or function
- the document format needed to trigger the bug
- the corruption offset or payload construction
- any exploit mitigation bypass
The description says only that a heap buffer can be overflowed when Word processes an attacker-supplied document. That points to a missing or incorrect length or bounds check when Word copies document data into a heap allocation. The usual fix for this kind of bug checks declared sizes and counts against the real allocation before copying. That is our inference from the bug class. No source confirms it is what Microsoft changed. Microsoft also published no code snippets, so this post includes none.
CVSS vector and the attack vector conflict
The published base vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
It records network attack vector, low attack complexity, no privileges required, required user interaction and unchanged scope. Confidentiality, integrity and availability impacts are all High. These impact metrics apply within the vulnerable component's security authority. They do not tell you which account the attacker's code would run as.
Microsoft's own FAQ disagrees with the vector. It states the attack vector is local (AV:L) and explains that "Remote" in the title refers to the attacker's location, not to how the bug is triggered. We do not try to resolve that conflict here. Two readings would both be wrong:
- ignoring the published AV:N value entirely
- treating this as an unattended network service exploit
The most concrete prerequisite, which both the vector (UI:R) and the FAQ support, is that a user has to open the malicious file. Keep document delivery and code execution as separate steps in your exposure assessment.
Attack flow
Based on Microsoft's documented scenario, exploitation proceeds as follows:
- The attacker builds a malicious Office file that triggers the heap overflow in Word. The file structure needed for this is not disclosed.
- The attacker sends the file to a target.
- The attacker persuades the recipient to open the file in Word. The Preview Pane is not an attack vector, so previewing the document alone does not trigger this CVE.
- Word processes the attacker-supplied content and writes past the end of a heap allocation.
- If exploitation succeeds, the attacker achieves code execution with High confidentiality, integrity and availability impact. The advisory does not establish administrator or SYSTEM-level execution.
Exploitation status
Microsoft frames its exploitability table as an assessment at the time of original publication. It records:
- Publicly disclosed: No
- Exploited: No
- Exploitability: Exploitation Less Likely
The "Publicly disclosed" field refers to details released before the advisory. It does not deny that the advisory exists.
CISA's Known Exploited Vulnerabilities catalog, version 2026.11.10, does not list this CVE. The isMalicious aggregator likewise reports no confirmed exploitation and no Exploit Database entry, Metasploit module or Nuclei template.
No threat actor, campaign, malware family or indicator set is tied to this CVE in the reviewed sources. All of this supports measured prioritization. It does not prove that private exploit development is absent.
Patch information
Microsoft released the official fix on November 10, 2026, as part of its November 2026 security updates. The MSRC advisory sets the CVSS temporal Remediation Level to Official Fix, meaning Microsoft considers it a complete vendor fix rather than a workaround.
The fix ships as updated Office binaries, and Microsoft defines "patched" by build number. Any installed build below the fixed build for your product line is still vulnerable. The fixed (first non-vulnerable) builds are:
- Microsoft Office LTSC 2021 (32-bit and 64-bit):
16.0.14334.21048, via the Microsoft 365 Apps security updates channel - Microsoft Office LTSC 2024 (32-bit and 64-bit):
16.0.17932.21140, via the Microsoft 365 Apps security updates channel - Microsoft 365 Apps for Enterprise (32-bit and 64-bit): varies by update channel, listed at aka.ms/OfficeSecurityReleases
- Microsoft Office 365 for Mac:
16.115.26110837, via the Office for Mac release notes or updater - Microsoft Office LTSC for Mac 2021:
16.115.26110837 - Microsoft Office LTSC for Mac 2024:
16.115.26110837
The advisory's Security Updates table contains nine product and architecture rows, all marked as fixed in this release. The CNA data shown on NVD lists the same affected ranges.
What this means in practice
- Windows Click to Run (Microsoft 365 Apps): There is no single fixed build. Each servicing channel (Current, Monthly Enterprise, Semi Annual Enterprise and so on) gets its own patched build. Find your channel's November 10, 2026 build in the Office security release listing and compare it with what is installed. Click to Run installs normally update themselves, but managed fleets that pin or defer channels need to be checked by hand.
- Office LTSC 2021 and 2024 (Windows): The 32-bit and 64-bit editions share one fixed build per product, so a simple version comparison is enough for inventory checks.
- macOS: All three Mac SKUs share the fixed build
16.115.26110837.
Installing the update
- Windows, individually managed: Open an Office application and create a document. Then select File > Account > Update Options > Update Now, selecting Enable Updates first if needed. If Update Options is missing and only About appears, the installation probably uses volume licensing or company-managed update policies. In that case, use Microsoft Update or your help desk.
- Mac, Office obtained from Microsoft: Open Word and select Help > Check for Updates, then Update. Microsoft also documents an Automatically keep Microsoft apps up to date option.
- Mac, Mac App Store installs: Use the App Store Updates page and select Update or Update All.
Caveats
- No workaround: The advisory provides none, and no registry setting, network filter or exploit prevention script either. Disabling or changing the Preview Pane is not a mitigation, because the Preview Pane is outside the attack vector.
- Release notes inconsistency: Microsoft's November Office security release notes do show LTSC 2021 Build 14334.21048 and LTSC 2024 Build 17932.21140. However, they list this CVE under Access, while the advisory identifies Word. That inconsistency does not mean Word is unaffected, and it does not establish Access as an additional affected product.
Because no code-level diff exists, the only reliable way to confirm a system is patched is to check its build against the list above.
Affected systems and versions
According to the affected product records reproduced by NVD and the CVE record:
- Microsoft 365 Apps for Enterprise: from 16.0.1. The upper bound is an update reference rather than a numeric version, so check the fixed build for your channel at Microsoft Office Security Releases.
- Microsoft Office 365 for Mac: 1.0.0 up to, but excluding, 16.115.26110837
- Microsoft Office LTSC 2021: 16.0.1 up to, but excluding, 16.0.14334.21048
- Microsoft Office LTSC 2024: 16.0.0 up to, but excluding, 16.0.17932.21140
- Microsoft Office LTSC for Mac 2021: 16.0.1 up to, but excluding, 16.115.26110837
- Microsoft Office LTSC for Mac 2024: 16.0.0 up to, but excluding, 16.115.26110837
Each product has its own boundary, and no single Office build number covers them all. Subscription and perpetual LTSC installs need to be checked against different release information.
Vendor security history
Microsoft is the assigning authority and vendor here. Its annual report describes a business spanning cloud services, software products and devices. The cited material does not establish a precise Office market share.
The Cyber Safety Review Board's examination of the summer 2023 Exchange Online intrusion offers an independent view of Microsoft's security governance. In that incident, a group associated with the Chinese government gained access to the official email accounts of senior United States government officials. The Board's findings included:
- The intrusion was preventable and resulted from a cascade of Microsoft security failures.
- An old signing key would not have remained valid if Microsoft had not paused manual rotation, had completed automatic rotation, or had alerts for aging keys.
- Microsoft's security culture was inadequate and required an overhaul.
Microsoft's July 2026 Secure Future Initiative report describes changes across culture, governance and engineering. These include identity isolation, removal of unused applications, stronger authentication and improved detection. They are Microsoft-reported outcomes, not an independent certification.
Neither the Exchange incident nor the SFI program is connected to this Word CVE, and neither tells you whether a given endpoint is patched. The build number does.
References
- NVD: CVE-2026-110062
- CVE Record: CVE-2026-110062
- Microsoft Security Update Guide: CVE-2026-110062
- CVE Services API record
- CVEfeed entry for CVE-2026-110062
- Microsoft Office Security Releases
- Release notes for Microsoft Office security updates
- Update history for Office for Mac
- How to update Microsoft 365 or Office for Windows
- Update Office for Mac automatically
- Zero Day Initiative: The November 2026 Security Update Review
- CISA Known Exploited Vulnerabilities feed
- isMalicious: CVE-2026-110062
- MITRE CWE-122: Heap based Buffer Overflow
- FIRST CVSS v3.1 Specification
- CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft SFI Progress Report July 2026
- Microsoft 2026 Annual Report
