Quick Look: CVE 2026 110064, a Heap-Based Buffer Overflow Enabling Remote Code Execution in Microsoft Office Word

Introduction

Microsoft's November 10, 2026 Patch Tuesday release fixed a heap-based buffer overflow in Microsoft Office Word that can lead to remote code execution once a user interacts with attacker-supplied content. The affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and the Office for Mac product line, so remediation for CVE 2026 110064 has to be tracked per product and, for Microsoft 365 Apps, per servicing channel.

Microsoft rates the issue Important, reported it as not publicly disclosed and not exploited at publication, and assessed exploitation as less likely. This post summarizes what the public sources say, what they leave unstated, and which builds contain the fix.

Technical Information

Classification and scoring

Microsoft's advisory describes the bug as a heap-based buffer overflow in Word that allows an unauthorized attacker to execute code over a network. The CVE record assigns two weakness types:

• CWE 122, Heap based Buffer Overflow: the out-of-bounds write happens in heap-allocated memory.
• CWE 197, Numeric Truncation Error: a larger numeric value is converted to a smaller type, losing its high-order bits and potentially leaving an unexpected value.

The Microsoft CVSS 3.1 vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Broken down:

• AV:N: network attack vector.
• AC:L: low attack complexity.
• PR:N: no privileges required.
• UI:R: user interaction is required.
• S:U: scope is unchanged.
• C:H / I:H / A:H: high impact to confidentiality, integrity, and availability.

The base score is 8.8. Microsoft's temporal score is 7.7, driven by the remediation level Official Fix (RL:O). NVD also records the base score as 8.8 (HIGH), while noting that its own assessment was not yet available when the briefing was compiled.

The network vector does not mean that being connected to a network is enough to trigger code execution. UI:R means a user has to take some action for the attack to succeed.

Root cause

Microsoft has not published source code, a diff, or a technical write-up for this vulnerability, so we cannot show the vulnerable Word code. We can reason from the two CWE assignments.

In bugs that pair CWE 197 with CWE 122, the common pattern is a mismatch between allocation size and copy size:

1. A size or length value is read or computed at a wide integer width.
2. That value is converted into a narrower integer type, losing its high-order bits.
3. The truncated, smaller value decides how much heap memory to allocate.
4. The original, larger value still governs how much data is copied into that allocation.
5. The copy runs past the end of the heap buffer and corrupts adjacent memory.

MITRE's generic description of CWE 122 notes that heap overflows can cause crashes and may allow arbitrary code execution. Applying this pattern to Word is an inference from the weakness classification. Microsoft has not confirmed the precise code path, the parser involved, or how the two weaknesses interact in this specific defect.

Attack flow

Based strictly on the CVSS vector and the advisory text, the attack conditions look like this:

1. Delivery: an unauthorized attacker with no privileges on the target (PR:N) gets content to the victim over a network path (AV:N). The sources do not specify a file format, delivery mechanism, or lure, so none should be assumed.
2. User action: the victim must interact (UI:R). Microsoft explicitly states that the Preview Pane is not an attack vector, so previewing alone is not the documented trigger. The sources do not describe the exact action required.
3. Processing: Word processes the attacker-controlled data. Under the inferred CWE 197 and CWE 122 pattern, a truncated size value leads to an undersized heap allocation followed by an oversized copy.
4. Corruption and impact: the heap overflow corrupts adjacent memory. With low attack complexity and high C, I, and A impact ratings, successful exploitation can result in code execution, with impact contained to the same security scope (S:U).

Exploitation status

At publication, Microsoft's advisory stated the vulnerability was not publicly disclosed and had not been exploited, and assessed it as Exploitation Less Likely. No threat actor is named. The CISA Known Exploited Vulnerabilities page reviewed for the briefing showed only results 1 to 20 of 1,779 and did not display this CVE, but a partial view cannot establish absence from the full catalog. These are point-in-time statements, so check the current MSRC and CISA entries before relying on them.

Patch Information

Microsoft fixed CVE 2026 110064 in its November 10, 2026 Patch Tuesday release. MSRC published the advisory that day as revision 1.0 with the temporal remediation level Official Fix (RL:O), meaning a complete vendor fix exists as a patch or upgrade. That remediation level is why the temporal score drops from 8.8 to 7.7.

What the fix likely changes

Given the CWE 197 and CWE 122 pairing, the update most likely introduces width-safe size handling or bounds checks in Word's parsing code, so that crafted input can no longer produce a mismatch between allocation size and copy size. This is an inference, and Microsoft has not confirmed the exact code change.

Fixed builds by product

According to the MSRC Security Updates table and NVD affected product data, any build below these versions is vulnerable:

• Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140 (Version 2408, Build 17932.21140)
• Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048 (Version 2108, Build 14334.21048)
• Microsoft Office 365 for Mac: 16.115.26110837
• Microsoft Office LTSC for Mac 2021: 16.115.26110837
• Microsoft Office LTSC for Mac 2024: 16.115.26110837
• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): channel-specific builds (MSRC points to aka.ms/OfficeSecurityReleases)

Microsoft 365 Apps channel builds

Microsoft 365 Apps is serviced through channels, so there is no single fixed version. Microsoft's Release notes for Microsoft Office security updates list CVE 2026 110064 under Word in the November 10, 2026 entry. Builds containing the fix:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel (receives Monthly Enterprise Channel builds): Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office 2024 Retail and Office 2021 Retail: Version 2610 (Build 20527.20196)

Delivery

• Windows: the fix arrives through Office's normal update channels. MSRC links each product's KB entry to the Office security release notes.
• Mac: the MSRC entries point to the Office for Mac release notes for the 16.115.26110837 update. Users can open an Office application such as Word and choose Help, then Check for Updates. Administrators can deploy update packages with their existing software deployment tools.

The fix ships in the same cumulative Office build as the other Word fixes from the November 2026 release, and there is no standalone hotfix for this CVE. Install the build for your channel, then confirm it by comparing the installed Office build number against the lists above. No workaround is documented for this CVE.

The November release notes also list a build for Office 2019 Volume Licensed (Build 10417.20236), but Office 2019 is not in the affected product list for this CVE. Do not treat that build as evidence of an Office 2019 fix for this vulnerability.

Affected Systems and Versions

The MSRC advisory and NVD record list the following affected ranges:

• Microsoft 365 Apps for Enterprise: versions from 16.0.1 are affected. The fixed version is channel specific (see the channel builds above), and the CVE record itself does not state a single fixed build.
• Microsoft Office 365 for Mac: versions from 1.0.0 and below 16.115.26110837.
• Microsoft Office LTSC 2021: versions from 16.0.1 and below 16.0.14334.21048.
• Microsoft Office LTSC 2024: versions from 16.0.0 and below 16.0.17932.21140.
• Microsoft Office LTSC for Mac 2021: versions from 16.0.1 and below 16.115.26110837.
• Microsoft Office LTSC for Mac 2024: versions from 16.0.0 and below 16.115.26110837.

No specific configuration is documented as required for exploitation beyond running an affected Word build and the user interaction implied by UI:R.

Vendor Security History

Microsoft's July 2026 Secure Future Initiative progress report presents the company's own security metrics: 99.97 percent of users and devices with phishing-resistant MFA coverage, more than 550,000 critical and high-risk open-source vulnerability instances remediated, and automated container patching that addresses about 3 million vulnerability instances monthly. These are vendor-reported program figures, not independent validation of this fix.

For independent context, the Cyber Safety Review Board's review of the summer 2023 Exchange Online intrusion by Storm 0558 found the intrusion was preventable and concluded that Microsoft's security culture was inadequate and required an overhaul. That report concerns Exchange Online, not Word, and no source links it to CVE 2026 110064.

On market position, the European Commission described Microsoft as holding a dominant position in the worldwide market for SaaS productivity applications for professional use, in a September 12, 2025 decision accepting commitments related to Teams and the Office 365 and Microsoft 365 business suites.

References

• NVD entry for CVE 2026 110064
• CVE Record for CVE 2026 110064
• Microsoft Security Update Guide: Microsoft Office Word Remote Code Execution Vulnerability
• Release notes for Microsoft Office security updates (Microsoft Learn)
• Office Security Releases (aka.ms link referenced by MSRC)
• Release notes for Office for Mac (Microsoft Learn)
• BleepingComputer: Microsoft November 2026 Patch Tuesday coverage
• isMalicious entry for CVE 2026 110064
• MITRE CWE 122: Heap based Buffer Overflow
• MITRE CWE 197: Numeric Truncation Error
• CISA Known Exploited Vulnerabilities Catalog
• Microsoft SFI Progress Report, July 2026
• Cyber Safety Review Board: Review of the Summer 2023 Microsoft Exchange Online Intrusion
• European Commission: commitments offered by Microsoft related to Teams