Introduction
A crafted Office document that is merely rendered in the Preview Pane can be enough to run attacker code with the privileges of the person looking at it. Microsoft fixed this use after free in Office, tracked as CVE-2026-111289, in its November 10, 2026 security release and rates it Critical, even though no exploitation was reported at publication.
The short version for anyone triaging the November release:
- Weakness: Use after free (CWE-416) in Microsoft Office, leading to remote code execution in the user's context.
- Severity: Microsoft rating Critical, CVSS 3.1 base score 8.8 (High), temporal score 7.7.
- Trigger: A user opens or previews a specially crafted Office file. Microsoft answers Yes to whether the Preview Pane is an attack vector.
- Exploitation at publication: Not publicly disclosed, not exploited, Exploitation Less Likely.
- Fix: Official vendor fix shipped November 10, 2026. Fixed builds differ per product.
Technical Information
Root cause: a memory lifetime failure
Microsoft's description is brief: "Use after free in Microsoft Office allows an unauthorized attacker to execute code over a network." The assigned weakness is CWE-416, Use After Free, and the advisory does not narrow the issue to a single Office application such as Word, Excel or PowerPoint.
MITRE defines this weakness class as referencing memory after it has been freed. Once an object is released, the allocator can hand the same memory to another part of the program while an older pointer still refers to it. Any operation through that stale pointer then acts on memory that now belongs to different code. At the class level, MITRE lists consequences including corruption of valid data, information disclosure through reads of freed memory, and, in some circumstances, arbitrary code execution. For this specific CVE, Microsoft's confirmed impact is remote code execution. The other class-level consequences have not been specifically demonstrated here.
The general pattern behind code execution from this bug class is straightforward: if an attacker can influence what gets allocated into the freed region, the stale pointer ends up following attacker-controlled data, which can be used to redirect execution. Microsoft has not said which object, function or parser is involved.
Reading the CVSS vector correctly
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- AV:N (Network): Classified as a remote attack. The malicious file can arrive over the network.
- AC:L (Low): The vector does not classify exploitation as requiring high complexity.
- PR:N (None): The attacker needs no prior access or privileges.
- UI:R (Required): A user must act. Per the advisory FAQ, that action is opening or previewing the file.
- S:U (Unchanged): Impact stays within the same security authority, which aligns with code running as the current user.
- C:H/I:H/A:H: High impact on confidentiality, integrity and availability.
Microsoft also publishes the temporal vector, which produces the separate 7.7 score:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
"Network" and "no privileges" do not mean zero interaction. A user still has to do something. Equally, "user interaction required" does not mean the user has to deliberately open and edit a document. Because the Preview Pane is an explicit attack vector, selecting a file so that Office renders a preview is within the documented trigger.
Attack flow as documented by Microsoft
Based only on the advisory's described scenario:
- The attacker prepares a specially crafted Office file. The file type, extension and internal structure are not disclosed.
- The attacker delivers the file to the target and convinces the user to interact with it.
- The user opens the file, or simply previews it, which causes Office to render the content and reach the vulnerable code path.
- The use-after-free condition is triggered and, on successful exploitation, attacker code executes with the privileges of that user.
The advisory does not describe a sandbox escape or any elevation beyond the user's own privileges.
What has not been published
Microsoft's description and FAQ do not provide the vulnerable function, the affected memory object, the file format or extension, a reproducible exploit, or an exploit chain. We are not aware of any public binary diff of the patched builds, so the exact nature of the fix is unconfirmed.
Exploitation status at publication
Microsoft's exploitability table, which it describes as reflecting the assessment at original publication, reports:
- Publicly disclosed: No
- Exploited: No
- Exploitability assessment: Exploitation Less Likely
- Exploit code maturity: Unproven (no publicly available exploit code, or the exploit is theoretical)
CISA's coordinator SSVC assessment in the CVE record, dated November 10, 2026, records Exploitation: none, Automatable: no and Technical Impact: total. The Zero Day Initiative's November review lists the CVE as Critical with a score of 8.8 and no reported disclosure or exploitation. Cisco Talos lists it as an Office use-after-free remote code execution vulnerability with a base score of 8.8, and CrowdStrike's November coverage describes the Office issue as following a preview-triggered pattern.
No threat actor, malware family, campaign, victim or CVE-specific indicator of compromise has been tied to this vulnerability in the reviewed reporting. The researcher acknowledgments in Microsoft's advisory are credits, not attribution. Read the status as "no active exploitation reported at publication." It does not mean the bug is unexploitable.
Patch Information
Microsoft fixed CVE-2026-111289 in the November 10, 2026 Patch Tuesday release. Office is closed source, so there is no public commit or diff. All fix evidence comes from Microsoft's advisory and the CVE record.
Official vendor fix
The MSRC advisory sets the CVSS temporal Remediation Level to Official Fix (RL:O), meaning Microsoft has shipped a complete fix and no workaround is needed. With the fix available, the score drops from a base of 8.8 to a temporal score of 7.7. The CVE record that Microsoft filed as the CNA tags its only reference, the MSRC advisory, as both a vendor advisory and a patch. The advisory's Security Updates table contains nine product and architecture rows, all released on November 10, 2026, and the advisory is at revision 1.0 with no changes since.
Fixed builds
The CVE record expresses each affected range as "version X up to, but not including, Y". Y is the first fixed build, so an installation is patched once it reaches that build:
- Microsoft Office LTSC 2021 (32-bit and x64): vulnerable from 16.0.1 up to 16.0.14334.21048; first fixed build 16.0.14334.21048
- Microsoft Office LTSC 2024 (32-bit and x64): vulnerable from 16.0.0 up to 16.0.17932.21140; first fixed build 16.0.17932.21140
- Microsoft 365 Apps for Enterprise (32-bit and x64): vulnerable from 16.0.1 up to the fixed build for your channel; see Microsoft's Office security release notes
- Microsoft Office 365 for Mac: vulnerable from 1.0.0 up to 16.115.26110837; first fixed build 16.115.26110837
- Microsoft Office LTSC for Mac 2021: vulnerable from 16.0.1 up to 16.115.26110837; first fixed build 16.115.26110837
- Microsoft Office LTSC for Mac 2024: vulnerable from 16.0.0 up to 16.115.26110837; first fixed build 16.115.26110837
Two cases differ from the simple pattern above:
- Microsoft 365 Apps has no single fixed build. Both the CVE JSON and NVD place a URL (aka.ms/OfficeSecurityReleases) in the version field instead of a build number. Microsoft 365 Apps ships on several servicing channels at once (Current, Monthly Enterprise and others), and each channel receives the November fix in a different build. You need to look up your channel in the security release notes. A scanner that simply compares against the CPE versionEndExcluding value cannot decide this case, because that value is a URL.
- All three Mac products share one fixed build, 16.115.26110837. The Mac fix shipped as a single update across Office 365 for Mac, LTSC for Mac 2021 and LTSC for Mac 2024, and the advisory points Mac users to the Office for Mac release notes for that update.
Microsoft's November 10, 2026 release notes list Office LTSC 2021 Volume Licensed as Version 2108, Build 14334.21048 and Office LTSC 2024 Volume Licensed as Version 2408, Build 17932.21140, which match the boundaries in the CVE record. Other editions appear in those release notes too, but their presence alone does not mean they are affected by this CVE. The CVE's affected product list defines scope.
How the fix is delivered
- Windows (LTSC 2021, LTSC 2024 and Microsoft 365 Apps): The fix arrives as a normal Click to Run Office build update, not a standalone KB package. Each advisory row links to the security release notes rather than a numbered KB article. The 32-bit and x64 editions of each product receive the same build number. Microsoft's instructions: File > Account > Update Options > Update Now. If Update Now is not available, select Enable Updates first.
- macOS: The fix arrives as the 16.115.26110837 Office for Mac update through Microsoft AutoUpdate or from the release notes page linked in the advisory. Microsoft's instructions: Help > Check for Updates, then Update. Microsoft also recommends selecting Automatically keep Microsoft apps up to date.
What the patch likely changes
Microsoft has not published technical details beyond the bug class. Fixes for use-after-free defects typically do one of the following: correct the object's lifetime with proper reference counting so it cannot be freed while still in use, null out or remove the dangling pointer when the object is freed, or add a check that prevents use of an object after teardown. We cannot confirm which approach Microsoft took without binary diffing, and no public patch analysis exists yet.
Because the Preview Pane is an attack vector, the vulnerable code runs when Office renders a file for preview as well as when it is opened. The patched build fixes the shared underlying code, so a single update closes both the open path and the preview path. The advisory does not establish disabling preview as a complete mitigation and documents no CVE-specific workaround.
Confirming you are patched
- Windows: In any Office app, go to File > Account > About (or Update Options) and read the build number. LTSC 2021 should be 14334.21048 or later, and LTSC 2024 should be 17932.21140 or later. For Microsoft 365 Apps, compare against the November 2026 security build for your channel in the release notes.
- macOS: Open About Microsoft Word/Excel/PowerPoint and confirm the version is 16.115 (26110837) or later.
- Fleet-wide: Microsoft's CPE data (cpe:2.3:a:microsoft:office_2021, office_2024, office_macos_2021, office_macos_2024, and office_365 for macOS) can drive automated version checks for every product except Microsoft 365 Apps, which requires per-channel build checks.
Affected Systems and Versions
Per Microsoft's affected product data as reproduced in the CNA and NVD records (upper bounds are excluded from the affected range):
- Microsoft 365 Apps for Enterprise, 32-bit and x64: from 16.0.1; upper bound is the channel-specific November 2026 security build
- Microsoft Office LTSC 2021, 32-bit and x64: 16.0.1 through builds below 16.0.14334.21048
- Microsoft Office LTSC 2024, 32-bit and x64: 16.0.0 through builds below 16.0.17932.21140
- Microsoft Office 365 for Mac: 1.0.0 through builds below 16.115.26110837
- Microsoft Office LTSC for Mac 2021: 16.0.1 through builds below 16.115.26110837
- Microsoft Office LTSC for Mac 2024: 16.0.0 through builds below 16.115.26110837
Any configuration in which a user can open or preview Office files on these builds is within the documented attack scenario, including use of the Preview Pane.
Vendor Security History
Microsoft positions Office within Microsoft 365 Commercial, a platform that brings together Office, Windows, Microsoft 365 Copilot and Enterprise Mobility + Security, alongside Office licensed for on-premises use. This CVE spans both subscription and LTSC product families on two operating systems, which reflects that structure.
The most significant recent public assessment of Microsoft's security practices is the Cyber Safety Review Board's review of the summer 2023 Exchange Online intrusion, in which a threat group associated with the government of the People's Republic of China compromised Microsoft's cloud environment and accessed email accounts of senior United States officials. The Board concluded the intrusion was preventable, resulted from a cascade of security failures, and that Microsoft's security culture was inadequate and required an overhaul. It also identified shortcomings in detection and in timely correction of inaccurate public statements.
In a June 13, 2024 response, Microsoft accepted responsibility for the issues the Board cited, committed to addressing all 16 recommendations applicable to it, and tied leadership compensation to security milestones. Its Secure Future Initiative is built on security by design, security by default, and continuous improvement of controls and monitoring.
This history concerns vendor governance. It has no established connection to the mechanism or any attacker of CVE-2026-111289. For this CVE, the concrete deliverable is the product-specific Office update.
References
- NVD entry for CVE-2026-111289
- Official CVE record (CVE Services API)
- CVE record JSON in the CVEProject cvelistV5 repository
- NVD API record for CVE-2026-111289
- Microsoft Security Update Guide: CVE-2026-111289
- MSRC CVRF document for November 2026
- Release notes for Microsoft Office security updates
- How to update Microsoft 365 or Office for Windows
- Update Office for Mac automatically
- Cisco Talos: Microsoft Patch Tuesday for November 2026
- Zero Day Initiative: The November 2026 Security Update Review
- CrowdStrike: November 2026 Patch Tuesday Updates and Analysis
- MITRE CWE-416: Use After Free
- Cyber Safety Review Board: Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft: Work to strengthen cybersecurity protection (June 2024)
- Microsoft Secure Future Initiative
- Microsoft 2026 Annual Report
