Introduction
A heap corruption flaw in Microsoft Office Word, fixed in the November 2026 Patch Tuesday release, lets a specially crafted document lead to code execution on both Windows and Mac installations, and Microsoft explicitly lists the Preview Pane as an attack vector. Word sits at the center of document handling in most organizations. A bug whose parsing path can be reached while a file is only being previewed is worth scheduling into the current patch cycle, even though Microsoft reported no exploitation at publication.
Technical Information
Root cause
CVE-2026-111285 is classified as CWE-122: Heap based Buffer Overflow. MITRE defines this class as a buffer overflow affecting memory allocated on the heap, for example through an allocation routine such as malloc(). Microsoft's description is short: a heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
In practical terms, a specially crafted document can cause Word to write past the end of a heap allocation, and an attacker can turn that memory corruption into code execution. Microsoft has not disclosed several details analysts would want:
- The specific Word component or parsing routine involved
- The malformed field or structure in the file that triggers the overflow
- The heap structure that gets overwritten
Word is closed source, so there is no public commit, diff, or patch notes describing the code change. Fixes for this bug class usually add or correct a bounds check, so that a length or count read from the file is validated against the real buffer size before data is copied. That is an inference from the CWE classification. Microsoft has not confirmed it. The sources support a vulnerability-class analysis, not a reconstruction of a working exploit.
Scoring
Microsoft, acting as CNA, published the following CVSS 3.1 base vector, which NVD reproduces:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Confidentiality, Integrity, Availability: High for each
That produces a base score of 8.8 (High). Microsoft separately rates the bug Critical under its own product severity classification. These are different rating systems, not contradictory scores. BleepingComputer's November 2026 roundup also lists it as a Critical Word remote code execution bug. Microsoft also publishes a 7.7 temporal score with the following temporal components:
E:U/RL:O/RC:C
Exploit maturity is Unproven, the remediation level is Official Fix, and report confidence is Confirmed. NVD's own assessment is not yet available, and the record shows Awaiting Analysis.
The AV:N metric should not be read as an interaction-free network attack. The same vector sets UI:R, and Microsoft's FAQ states that a user must open a specially crafted file.
Attack flow
The advisory documents this sequence:
- The attacker prepares a specially crafted file designed to trigger the overflow in Word's parsing code. The sources do not specify the file extension, document format, or whether macros are involved (nothing indicates macros are required).
- The file reaches the target. The advisory does not name a specific delivery channel, so we do not assume email or any other vector here.
- The victim either opens the file in Word, or the file is rendered through the Preview Pane. Microsoft's FAQ lists the Preview Pane as an attack vector, meaning the vulnerable parsing code can run when a file is only previewed, for example in Outlook or File Explorer, not only when it is fully opened.
- While parsing the document, Word writes past the end of a heap allocation.
- The attacker uses the resulting heap corruption to achieve code execution.
The advisory does not describe the exact preview interaction or rendering sequence that reaches the flaw, and nothing in the sources establishes an exploit that works without any user action.
Exploitation status at publication
Microsoft qualifies its exploitability assessment as applying at the time of original publication:
- Publicly disclosed: No
- Exploited: No
- Exploitability assessment: Exploitation Less Likely
- Exploit code maturity: Unproven
- Official fix available: Yes
The reviewed sources identify no threat actor, campaign, victim organization, malware family, indicators of compromise, or public proof of concept for this CVE. Microsoft credits Kentaro Kawane with GMO Cybersecurity by Ierae, Inc. for the report. That is a research acknowledgement, not attribution of malicious activity. A lower likelihood rating does not change the documented impact, and these fields should not be treated as a permanent statement about activity after publication.
Patch Information
Microsoft released the fix on November 10, 2026 as part of that month's Patch Tuesday. The MSRC advisory sets the temporal Remediation Level to Official Fix (RL:O), meaning a complete vendor fix has shipped and it does not depend on a workaround.
Because the flaw lives in Word's document rendering code, the fix is delivered as an updated Office build. There is no separate Outlook or Windows component to patch, even though the Preview Pane is an attack vector. The fix only takes effect once the patched Word binaries are installed.
Fixed builds from the MSRC Security Updates table
- Microsoft Office LTSC 2024 (32 bit and 64 bit):
16.0.17932.21140 - Microsoft Office LTSC 2021 (32 bit and 64 bit):
16.0.14334.21048 - Microsoft Office 365 for Mac:
16.115.26110837 - Microsoft Office LTSC for Mac 2024:
16.115.26110837 - Microsoft Office LTSC for Mac 2021:
16.115.26110837 - Microsoft 365 Apps for Enterprise (32 bit and 64 bit): per channel, see the Office security release notes
The two Windows LTSC editions have different fixed builds, while the three Mac products share one threshold. Do not substitute one product's build for another product's advisory entry.
Microsoft 365 Apps channel builds
Microsoft 365 Apps is serviced through update channels, so MSRC links to the Office security release notes instead of giving a single build number. The November 10, 2026 release notes list CVE-2026-111285 with these builds, among others:
- Current Channel: Version 2610 (Build
20527.20196) - Monthly Enterprise Channel: Version 2610 (Build
20527.20194), Version 2609 (Build20430.20264), Version 2608 (Build20326.20320) - Office LTSC 2024 Volume Licensed: Version 2408 (Build
17932.21140) - Office LTSC 2021 Volume Licensed: Version 2108 (Build
14334.21048)
Semi Annual Enterprise Channel builds are published in the same release notes, so check your channel's exact build there. For Click to Run installs, a version at or above your channel's listed build means the fix is installed.
Mac update mechanism
Microsoft's Office for Mac release notes state that updates are available through Microsoft AutoUpdate. Users can open an Office application such as Word and choose Help > Check for Updates. Administrators can also download application update packages and deploy them with their existing software deployment tooling.
Verifying deployment
Go to File > Account > About Word in each Office installation, or use endpoint management inventory, and compare the reported version against the builds above. On Mac, Office 365 and both LTSC editions should report 16.115.26110837 or later.
On workarounds
The advisory does not publish a CVE-specific workaround or a validated configuration change that substitutes for patching. In particular, the Preview Pane warning is not an assurance that disabling preview fully mitigates the flaw. The documented remediation is the vendor update.
Affected Systems and Versions
The affected ranges the CNA supplied in the CVE record and NVD match the fixed build boundaries:
- Microsoft 365 Apps for Enterprise (32 bit and x64): from 16.0.1 up to the security release referenced by Microsoft. The CVE record gives no single numeric threshold, so use the channel builds listed above
- Microsoft Office LTSC 2021 (32 bit and x64): from 16.0.1 up to, but not including, 16.0.14334.21048
- Microsoft Office LTSC 2024 (32 bit and x64): from 16.0.0 up to, but not including, 16.0.17932.21140
- Microsoft Office 365 for Mac: from 1.0.0 up to, but not including, 16.115.26110837
- Microsoft Office LTSC for Mac 2021: from 16.0.1 up to, but not including, 16.115.26110837
- Microsoft Office LTSC for Mac 2024: from 16.0.0 up to, but not including, 16.115.26110837
The MSRC advisory contains nine update rows covering these Windows architectures and Mac editions. Microsoft's broader Microsoft 365 portfolio includes web and mobile applications, but the affected product list above defines the scope of this CVE.
Vendor Security History
Microsoft is both the vendor and CNA here. For market context, the UK Competition and Markets Authority's May 14, 2026 investigation notice describes Microsoft's Office productivity suite as part of a broader business software ecosystem, states that Microsoft supplies products critical to UK organizations, and notes that its 2025 cloud investigation found significant market power in productivity software. The 2026 notice opens an investigation. It is not a final strategic market status designation.
On track record, DHS released the Cyber Safety Review Board's findings on the Summer 2023 Exchange Online intrusion on April 2, 2024. The Board found the intrusion preventable, attributed it to an actor assessed as affiliated with the People's Republic of China, and recommended improvements to identity and credential controls, default audit logging, disclosure practices, and victim notification. Microsoft cooperated with the review. Those findings concern Exchange Online and have no bearing on attribution for this Word flaw.
Microsoft's July 2026 Secure Future Initiative progress report describes vendor-reported measures such as reducing public resource exposure, expanding network isolation, and automating vulnerability remediation. That program addresses broader security engineering. For CVE-2026-111285 specifically, the Word update is what closes the issue.
References
- NVD: CVE-2026-111285
- CVE Record: CVE-2026-111285
- MSRC Security Update Guide: CVE-2026-111285, Microsoft Office Word Remote Code Execution Vulnerability
- NVD API record for CVE-2026-111285
- BleepingComputer: Microsoft November 2026 Patch Tuesday roundup
- Microsoft Learn: Microsoft 365 Apps security updates
- Microsoft Learn: Release notes for Microsoft Office security updates
- Microsoft Learn: Release notes for Office for Mac
- MITRE CWE-122: Heap based Buffer Overflow
- Zero Day Initiative: The November 2026 Security Update Review
- DHS: Cyber Safety Review Board report on the Summer 2023 Microsoft Exchange Online incident
- Microsoft Security Blog: July 2026 progress report on the Secure Future Initiative
- Microsoft annual report on Form 10K, filed July 29, 2026
- Microsoft 365 for Work: Business Productivity Apps
- UK Competition and Markets Authority: Investigation Notice
