Brief Summary: Microsoft Word CVE-2026-111290 Heap-Based Buffer Overflow Leading to Code Execution

Introduction

A crafted Word document, delivered to a user and handled in a specific way, can run attacker code with that user's permissions on any unpatched Microsoft 365 Apps or Office LTSC installation. Microsoft fixed this heap-based buffer overflow in its November 10, 2026 Patch Tuesday release, rating it 8.8 (High) under CVSS 3.1 and Important on its own severity scale.

What sets this bug apart from the usual "open a document, get owned" Office flaw is the trigger. According to Microsoft, opening the file is not enough. The victim must enable editing and then apply a sharpening correction to an embedded picture. The Preview Pane is explicitly not an attack vector. Defenders have to weigh the high potential impact against those narrow interaction requirements.

The input CVE data lists the vendor as unknown. The NVD record, the CVE record and the MSRC advisory all identify Microsoft as the source and Word as the vulnerable application.

Technical information

Root cause

Microsoft classifies the weakness as CWE-122, Heap-based Buffer Overflow. MITRE defines this as a buffer overflow where the overwritten buffer was allocated in the heap. Its generic guidance notes that heap corruption can overwrite adjacent data or function pointers and may lead to arbitrary code execution. That describes the weakness class only. Microsoft has not said which heap object or control structure this particular Word bug corrupts.

Word is closed source. There is no public commit, diff or vulnerable code to examine, and the advisory does not name a vulnerable function, image format, malformed document field, memory offset or exploit payload.

Where the bug probably lives

Microsoft has not said which component it changed. Two observations narrow it down, though both are inferences rather than confirmed facts:

• The trigger is a sharpening correction applied to an embedded picture, which points to Word's picture correction (image processing) path. That is the most likely place where length or bounds handling was fixed.
• Microsoft's November release notes list CVE-2026-111290 under Office suite rather than under the Word-specific section. This may mean the fixed code is shared across Office applications, but Microsoft has not confirmed it.

CVSS interpretation

Microsoft publishes the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• AV:N, AC:L: network attack vector, low attack complexity.
• PR:N, UI:R: the attacker needs no privileges, but user interaction is required.
• S:U, C:H, I:H, A:H: unchanged scope with high confidentiality, integrity and availability impact.
• E:U, RL:O, RC:C: unproven exploit maturity, official fix available, confirmed report. These temporal metrics bring the temporal score to 7.7. The base score remains 8.8.

Network delivery and automatic execution are different things. AV:N reflects that the malicious document can arrive over the network. It does not mean the bug fires without the user acting. Microsoft's FAQ is explicit about the required actions, and both facts belong in any accurate risk assessment. Nothing in the vector or the advisory indicates execution beyond the affected user's own permissions.

Attack flow

Based on Microsoft's advisory, the documented scenario looks like this:

1. The attacker builds a specially crafted Word document containing an embedded picture. The specific malformation is not disclosed.
2. The attacker delivers the document to the target and convinces them to open it. Microsoft does not identify a particular delivery channel. The attacker does not need an account on the target system.
3. The user opens the document and enables editing. Merely previewing the document in the Preview Pane does not trigger the bug.
4. The user applies a sharpening correction to the embedded picture.
5. Processing that correction triggers the heap overflow, and attacker code executes with the user's permissions.

This multistep requirement is why Microsoft assesses exploitation as Less Likely, even though the potential impact of successful exploitation is high. The two assessments answer different questions (how bad it is if it works, and how likely it is to work in practice), and neither cancels the other.

Exploitation status

As of November 11, 2026, the reviewed sources do not show active exploitation or a named threat actor:

• Microsoft's advisory records "Publicly disclosed: No", "Exploited: No" and "Exploitation Less Likely". Exploit maturity is "Unproven", which Microsoft defines as no publicly available exploit code or only a theoretical exploit.
• CISA's contribution to the CVE record, timestamped November 10, 2026 at 20:38:41 UTC, lists "Exploitation: none", "Automatable: no" and "Technical Impact: total".
• The NVD record is marked Awaiting Enrichment, a status that says nothing about fix availability.
• Microsoft credits Kentaro Kawane of GMO Cybersecurity by Ierae, Inc. with the report. That credit acknowledges the researcher. It does not attribute any activity to a threat actor.

These assessments are dated and guarantee nothing about later activity. No CVE-specific malicious document hashes, attacker infrastructure or public exploit walkthrough appear in the sources we reviewed.

How existing controls relate to this bug

• Protected View opens untrusted files in a read-only mode with most editing disabled, and Microsoft advises enabling editing only for trusted sources. Because the documented attack requires the user to enable editing, this guidance is directly relevant. However, the Protected View documentation does not establish it as a CVE-specific workaround.
• The Defender attack surface reduction rule "Block all Office applications from creating child processes" constrains a common malware behavior after code execution. It has compatibility considerations for legitimate line-of-business applications and installation location requirements, and Microsoft does not state that it prevents this CVE.
• The ASR rule that blocks Win32 API calls from Office macros governs VBA behavior and is not documented as relevant to this image-processing flaw.

Microsoft does not publish a dedicated workaround for this vulnerability. These controls are supplementary and do not replace the update.

Patch information

Microsoft has released an official fix, shipped in the November 10, 2026 Patch Tuesday release. Because Word is closed source, the fix comes as rebuilt Office binaries. The practical question for defenders is which build number to reach.

How Microsoft classifies the fix

MSRC published the advisory as Microsoft Office Word Remote Code Execution Vulnerability. The temporal vector ends in RL:O (Remediation Level: Official Fix), meaning a complete vendor fix exists. This is why the temporal score is 7.7 against the 8.8 base score.

Fixed builds

Versions below these builds are vulnerable:

• Office LTSC 2024 (32-bit and 64-bit): Version 2408, 16.0.17932.21140
• Office LTSC 2021 (32-bit and 64-bit): Version 2108, 16.0.14334.21048
• Microsoft 365 Apps for Enterprise (32-bit and 64-bit): the November 10, 2026 build for your update channel, listed below

MSRC does not give a single build number for Microsoft 365 Apps. Instead, it points to the Office security release notes. The November 10, 2026 builds are:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel:
  • Version 2610 (Build 20527.20194)
  • Version 2609 (Build 20430.20264)
  • Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel:
  • Version 2610 (Build 20527.20192)
  • Version 2609 (Build 20430.20262)
  • Version 2608 (Build 20326.20318)
• Office 2024 and Office 2021 Retail: Version 2610 (Build 20527.20196)

The previous month's LTSC builds were 17932.21056 (LTSC 2024) and 14334.20974 (LTSC 2021). If a machine still reports those builds, or anything older, it is still vulnerable.

Delivery

• Click to Run installations (Microsoft 365 Apps, retail, and LTSC installed from the Office CDN) update through Office's normal update mechanism. Confirm the fix by checking the version and build under File > Account > About against the list above. Where update controls are available, Microsoft's documented procedure is File > Account > Update Options > Update Now (you may need to select Enable Updates first). If only About appears, the installation is likely managed through volume licensing or Group Policy.
• Volume-licensed LTSC builds are available through the security update download links on the MSRC advisory and through the Microsoft Update Catalog.
• The same November release also produced Office 2019 Volume Licensed Version 1808 (Build 10417.20236), but Office 2019 is not listed as affected on the MSRC page for this CVE.

You have the fix once Word reports a build at or above the one listed for your product and channel.

Affected systems and versions

Per the CVE record and MSRC advisory, the affected product families cover both 32-bit and x64 Windows architectures:

• Office LTSC 2021: versions from 16.0.1 up to, but not including, 16.0.14334.21048
• Office LTSC 2024: versions from 16.0.0 up to, but not including, 16.0.17932.21140
• Microsoft 365 Apps for Enterprise: the affected range begins at 16.0.1. The upper boundary is defined by the Office security release information for each update channel (see the channel builds above) rather than by a single numeric fixed build.

Vulnerable configuration: any of the above builds where a user can open a document, enable editing and apply a picture sharpening correction. Office 2019 is not listed as affected.

Vendor security history

Microsoft's broader security record provides context but is separate from this specific defect.

The Cyber Safety Review Board's review of the Summer 2023 Exchange Online intrusion found that Microsoft's operational and strategic decisions reflected a corporate culture that deprioritized enterprise security investment and rigorous risk management. The Board also cited delayed correction of inaccurate public statements and inadequate forensic evidence. Microsoft could not demonstrate how the attacker obtained the signing key involved. The Board recommended direct CEO and Board attention and a publicly shared reform plan.

Microsoft's July 2026 Secure Future Initiative report describes embedding security across culture, governance and engineering, including broader use of centrally governed build templates, remediation of high-risk open-source vulnerability instances, automated container patching and additional detections. These changes are vendor-reported, not independent findings about Word's picture processing code.

Neither source establishes the cause or exploitability of CVE-2026-111290. Evaluate Microsoft's governance trajectory and this product-level fix as separate questions.

References

• NVD entry for CVE-2026-111290
• Official CVE record (CVE Services API)
• Microsoft Security Update Guide advisory
• Microsoft 365 Apps security updates release notes
• Release notes for Microsoft Office security updates
• Rapid7 vulnerability database entry
• Zero Day Initiative: The November 2026 Security Update Review
• CISA Known Exploited Vulnerabilities Catalog
• MITRE CWE 122: Heap based Buffer Overflow
• How to update Microsoft 365 or Office for Windows
• What is Protected View?
• ASR rules reference, Microsoft Defender for Endpoint
• cvefeed.io entry
• Microsoft 2026 Annual Report
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Secure Future Initiative Progress Report, July 2026