Quick Look: Microsoft Office Word CVE-2026-110067 Use After Free Remote Code Execution

Introduction

A use after free in Microsoft Office Word, fixed in Microsoft's November 10, 2026 security release, can let an attacker with no account on the target run code in the context of the logged-on user through a crafted document. Microsoft explicitly confirms that the Preview Pane is an attack vector. Word sits at the center of document workflows in most organizations, so defenders' time is better spent matching every Office installation, on Windows and Mac, to the correct fixed build for its servicing channel than debating severity.

The CVSS v3.1 base score is 8.8 (High), while Microsoft's own maximum severity rating is Critical. These come from different rating systems and are not contradictory. NVD currently lists the record as Awaiting Analysis, and the vendor field supplied in some feeds as "Unknown" is incorrect: Microsoft is both the affected vendor and the assigning CNA.

Technical Information

Root cause: CWE-416

Microsoft classifies the flaw as CWE-416, Use After Free. MITRE defines this weakness as referencing memory after it has been freed. Once freed, that memory can be handed to a different allocation while an older pointer still refers to it, so any read, write, or virtual call made through the stale pointer operates on data the code no longer owns. If an attacker can influence what occupies the freed region, the stale reference can be turned into control over execution.

This describes the weakness class in general, and does not reconstruct this specific bug. Office is closed source, and Microsoft has not disclosed:

• which Word component or object type is affected
• the faulty function or code path
• the memory layout or a reproducible corruption sequence
• how the object's lifetime handling was changed by the fix

We therefore do not include any code or pseudocode here. Per the advisory, successful exploitation results in code execution with the user's permissions. Nothing in the advisory says exploitation grants administrator or kernel privileges on its own.

Reading the CVSS vector

NVD records the Microsoft-supplied base vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H:

• AV:N (Network): remotely exploitable, for example through a delivered file
• AC:L (Low): no special conditions beyond the described scenario
• PR:N (None): the attacker needs no prior privileges or account
• UI:R (Required): a user must take part in successful exploitation
• S:U (Unchanged): no security authority boundary is crossed in the base assessment
• C:H / I:H / A:H: high impact to confidentiality, integrity, and availability

Taken together, the vector describes a bug that is reachable over the network and needs no privileges, but does need user interaction. Microsoft also publishes a temporal score of 7.7 with E:U/RL:O/RC:C (exploit maturity Unproven, Official Fix, Confirmed report), which does not alter the 8.8 base score.

Attack flow described by Microsoft

The MSRC FAQ describes the following scenario:

1. The attacker crafts a malicious Word document and gets it to the victim.
2. The attacker persuades the user to open the document.
3. The user saves the document as Rich Text Format.
4. The user dismisses the conversion and document protection prompts.
5. The use after free is triggered in Word's document handling path, and the attacker's code can run with the user's permissions.

CrowdStrike's November analysis places this CVE among Word issues associated with malicious documents delivered as attachments or file links, which is general scenario context rather than evidence of real-world use.

The Preview Pane question

In a separate FAQ entry, Microsoft answers "Yes" to whether the Preview Pane is an attack vector. The advisory does not explain how preview rendering relates to the longer sequence of opening the file, saving it as RTF, and dismissing the prompts, and we found no source that reconciles the two. Our read is that any exposure assessment should keep both statements. The documented workflow is one path, and the Preview Pane is a confirmed exposure that does not require the user to fully open the file in the normal way. Avoiding document opens alone should not be treated as eliminating exposure.

Exploitation status

At original publication Microsoft recorded "Publicly disclosed: No", "Exploited: No", and "Exploitation Less Likely", with exploit code maturity Unproven. Independent release reviews agree. Zero Day Initiative lists the CVE as Critical, 8.8, not publicly known and not exploited, and Cisco Talos describes it as a Word use after free RCE with an 8.8 base score without naming any campaign.

Other data points:

• CISA SSVC enrichment in NVD: exploitation none, automatable no, technical impact total. These describe different aspects of risk and do not conflict.
• isMalicious reports no Exploit DB entry, no Metasploit module, no Nuclei template, and that the CVE is not in CISA KEV.
• CISA's November 10, 2026 KEV addition included CVE-2026-124194, an Outlook vulnerability. That is a different CVE, and its exploitation should not be attributed to this Word bug.

The reviewed sources identify no threat actor, campaign, victim list, payload family, or CVE-specific indicators of compromise. These are publication-time assessments and not guarantees about future activity.

Patch Information

Microsoft fixed CVE-2026-110067 in its November 10, 2026 Patch Tuesday release, and MSRC lists the remediation level as Official Fix. Since the vulnerable code lives in the Word binaries' parsing and preview logic, installing the new build is the only real fix. No configuration change does the same job, and no CVE-specific workaround is documented.

Fixed builds by product

The MSRC advisory lists nine affected product variants (32-bit and 64-bit editions counted separately):

• Microsoft Office LTSC 2024 (32/64 bit): 16.0.17932.21140, Click to Run, Version 2408
• Microsoft Office LTSC 2021 (32/64 bit): 16.0.14334.21048, Click to Run, Version 2108
• Microsoft Office 365 for Mac, Office LTSC for Mac 2021 and 2024: 16.115.26110837, via Microsoft AutoUpdate and the Mac release notes
• Microsoft 365 Apps for Enterprise (32/64 bit): no single build. MSRC points to aka.ms/OfficeSecurityReleases

Microsoft 365 Apps: builds per channel

The November 10, 2026 entry in Microsoft's Office security update release notes lists CVE-2026-110067 under Word with these fixed builds:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel (receives Monthly Enterprise builds): Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office 2024 Retail / Office 2021 Retail: Version 2610 (Build 20527.20196)
• Office LTSC 2024 Volume Licensed: Version 2408 (Build 17932.21140)
• Office LTSC 2021 Volume Licensed: Version 2108 (Build 14334.21048)

The record does not support substituting an LTSC threshold for a Microsoft 365 Apps threshold. Check the build for the channel that is actually installed.

Verifying the update

Compare the build shown under File > Account > About with the fixed build for your channel. For reference, the October 2026 LTSC builds were 17932.21056 (LTSC 2024) and 14334.20974 (LTSC 2021). Any system still on those builds, or older, does not have the fix.

Cumulative contents

The same November build also fixes other Word issues, including CVE-2026-110047 (another use after free), CVE-2026-111285 (heap-based buffer overflow), and CVE-2026-124185 (use of uninitialized resource). Office updates are cumulative, so later monthly builds also include this fix.

A note on tracker discrepancies

The isMalicious entry states "No fix published by the sources we read yet," which conflicts with MSRC's Official Fix designation and the matching builds in Microsoft's release notes. The vendor records are the stronger basis for remediation decisions.

What is not public

Microsoft has not said which Word component was patched or how object lifetime handling changed. Without diffing the binaries, it is not possible to say whether the fix adds reference counting, reorders when the object is freed, or adds a validity check.

Affected Systems and Versions

The CVE record and NVD (copying Microsoft's CNA data) list six affected product families:

• Microsoft 365 Apps for Enterprise, 32 bit and x64: from 16.0.1, before the applicable Office security release for the installed channel
• Microsoft Office 365 for Mac: from 1.0.0, before 16.115.26110837
• Microsoft Office LTSC 2021, 32 bit and x64: from 16.0.1, before 16.0.14334.21048
• Microsoft Office LTSC 2024, 32 bit and x64: from 16.0.0, before 16.0.17932.21140
• Microsoft Office LTSC for Mac 2021: from 16.0.1, before 16.115.26110837
• Microsoft Office LTSC for Mac 2024: from 16.0.0, before 16.115.26110837

These are the boundaries recorded for this CVE. They should not be read as a statement about every Office edition or delivery form. Word is also available on web and mobile through Microsoft 365, but that does not mean those forms are affected, since only the families above appear in the record.

Vendor Security History

The UK Competition and Markets Authority reports that Microsoft business software is used by over one million UK businesses and public sector organizations, with around 20 million monthly users, and has proposed (not finally established) strategic market status. Those figures describe the ecosystem, not the number of vulnerable Word installations.

The Cyber Safety Review Board's review of the 2023 Exchange Online intrusion is the most prominent documented failure case. A threat actor obtained a Microsoft signing key and exploited token validation weaknesses to access enterprise email, including accounts associated with senior US officials. The Board concluded the intrusion should never have happened, criticized decisions that deprioritized enterprise security investment and rigorous risk management, and recommended making security a design requirement. That was a separate cloud identity incident with no connection to CVE-2026-110067.

Microsoft's July 2026 Secure Future Initiative progress report describes the company's corrective program. Selected vendor-reported figures:

• Phishing-resistant MFA: 99.97% user and device coverage
• Unused Entra applications decommissioned: 1.4 million
• Credential isolation across boundaries: 98.7%
• Critical and high-value build pipelines on centrally governed templates: 93%
• Critical and high-risk open-source vulnerability instances remediated: more than 550,000
• Vulnerability instances addressed by automated container patching: about 3 million each month
• New detections introduced: more than 100
• CVEs published with CWE and CPE annotations: 1,989

These are organization-wide outcomes reported by Microsoft itself. Neither the CSRB findings nor the SFI numbers say anything about the reliability of this particular Word component, and neither is a substitute for installing the November build.

References

• NVD: CVE-2026-110067
• CVE Record: CVE-2026-110067
• Microsoft Security Update Guide: CVE-2026-110067
• Release notes for Microsoft Office security updates (Microsoft Learn)
• Release notes for Office for Mac (Microsoft Learn)
• NVD API record for CVE-2026-110067
• Cisco Talos: Microsoft Patch Tuesday for November 2026
• Zero Day Initiative: The November 2026 Security Update Review
• CrowdStrike: November 2026 Patch Tuesday Updates and Analysis
• MITRE CWE-416: Use After Free
• isMalicious: CVE-2026-110067
• CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog (November 10, 2026)
• CISA Known Exploited Vulnerabilities feed
• CISA: Cyber Safety Review Board Report on Summer 2023 Microsoft Online Exchange Incident
• CSRB: Review of the Summer 2023 Microsoft Exchange Online Intrusion (PDF)
• Microsoft Trust Center: SFI Progress Report July 2026
• GOV.UK: CMA takes first steps to ensure choice in business software
• Microsoft 365 for Work: Business Productivity Apps