Overview of CVE-2026-111294: Heap-Based Buffer Overflow in Microsoft Word Reached Through Edit Points

Introduction

Microsoft's November 10, 2026 Patch Tuesday release fixed a heap-based buffer overflow in Word that can give an attacker code execution with the permissions of whoever edits a crafted document. CVE-2026-111294 is worth a closer look because of the gap between its 8.8 CVSS base score and its unusually specific trigger. The victim has to open the file for editing and use Edit Points on an embedded shape, and the Preview Pane is explicitly not an attack vector.

This post is a brief summary of what Microsoft and NVD have published, which builds carry the fix, and where the public record still has gaps.

Technical information

Root cause

Microsoft classifies the weakness as CWE 122, Heap Based Buffer Overflow. MITRE defines this class as a buffer overflow in which the overwritten buffer was allocated in the heap portion of memory. That establishes the memory corruption category, but the advisory does not identify the vulnerable function, the malformed file structure, the heap layout, or any memory offsets.

The one concrete clue Microsoft provides is the trigger. Because the overflow is reached through Edit Points on an embedded shape, the code that parses and edits shape geometry (vertex and path data) is the most plausible location of the bug. Fixes for CWE 122 issues typically add bounds checks on attacker-supplied lengths or counts before data is copied into a heap buffer, or correct the size calculation used when that buffer is allocated. Without a binary diff, we cannot confirm which approach Microsoft took, so treat this as the likely shape of the fix rather than a verified detail.

Impact boundary

Microsoft labels the issue remote code execution, and its FAQ narrows the impact: successful exploitation runs code with the user's permissions. The attacker does not need an account on the affected system, but the advisory does not establish automatic administrator or SYSTEM-level access.

Attack flow

Based on the advisory FAQ, the documented exploitation sequence is:

1. The attacker prepares a specially crafted Word document containing an embedded shape.
2. The attacker provides the document to the target and convinces them to open it.
3. The victim opens the document for editing (simply receiving it or viewing it in the Preview Pane is not the documented path).
4. The victim selects Edit Points on the embedded shape.
5. The heap-based buffer overflow is triggered and attacker code executes in the context of the victim user.

Defenders should not generalize this CVE to every Word document open, to Preview Pane rendering, or to unrelated Office exploits.

Reading the CVSS vector

Microsoft's full vector, including temporal metrics, is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

The base score is 8.8 and the temporal score is 7.7. NVD attributes the assessment to Microsoft and has not published its own.

• AV:N (Network): the file can be delivered remotely. This is not evidence of a listening Word service.
• AC:L / PR:N: no special conditions and no attacker privileges are required.
• UI:R (Required): the victim must act, and the FAQ specifies editing and Edit Points.
• S:U / C:H / I:H / A:H: high impact within the same security authority.
• E:U (Unproven): no publicly available exploit code, or a theoretical exploit.
• RL:O (Official Fix): a complete vendor fix exists, which is why the temporal score drops to 7.7.
• RC:C (Confirmed): the vendor has confirmed the vulnerability.

The vector pairs no attacker privileges with required victim interaction. The C:H, I:H, and A:H ratings describe the consequences of successful exploitation, not the likelihood that any given attempt succeeds.

Exploitation status

Microsoft's exploitability assessment, explicitly scoped to the time of original publication, records "Publicly disclosed: No", "Exploited: No", and "Exploitation Less Likely". No threat actor, campaign, malware family, or indicator set is attributed to this CVE in the Microsoft or NVD records we examined. Microsoft credits Kentaro Kawane of GMO Cybersecurity by Ierae, Inc. with reporting the bug through coordinated disclosure.

The apparent tension between an 8.8 score and Exploitation Less Likely resolves once you separate the two: one measures the impact of successful exploitation, the other is Microsoft's publication-time judgment about exploitability. Neither predicts future activity.

Patch information

Microsoft fixed CVE-2026-111294 in the November 10, 2026 Patch Tuesday release (MSRC advisory revision 1.0). The fix is a closed-source binary update, so there is no public commit or diff. The useful evidence is Microsoft's documentation of which builds contain the fix and how each servicing channel receives it.

Microsoft's Release notes for Microsoft Office security updates lists this CVE under the Office suite heading for November 10, 2026, not under the Word heading. Even though the bug is in Word, the fix ships in the shared Office suite update. You cannot patch Word on its own.

Microsoft 365 Apps and retail builds

Microsoft 365 Apps updates through several Click to Run channels, each on its own build line, so MSRC points to aka.ms/OfficeSecurityReleases instead of a single number. The November 10, 2026 release notes list:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel (receives Monthly Enterprise Channel builds): Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office 2024 Retail and Office 2021 Retail: Version 2610 (Build 20527.20196)
• Office LTSC 2024 Volume Licensed: Version 2408 (Build 17932.21140)
• Office LTSC 2021 Volume Licensed: Version 2108 (Build 14334.21048)

The LTSC builds in the release notes match the MSRC and NVD fixed versions, which is a good sign that the November build line is where the fix landed for every Windows channel.

Applying and verifying the update

Office on Windows:

1. Open an Office application such as Word and create a new document.
2. Select File > Account.
3. Under Product Information, select Update Options > Update Now (select Enable Updates first if needed).
4. If only About appears and Update Options is absent, the install likely uses volume licensing or company Group Policy. Microsoft's documented alternatives are Microsoft Update or your help desk.
5. Confirm the Version/Build string under File > Account > About is at or above the build for your channel.

Office on Mac: use Help > Check for Updates from any Office application, or download and deploy the application update packages with your existing software deployment tools. Word should report 16.115.26110837 or later.

Click to Run installs pull the build automatically through their configured channel. Volume-licensed LTSC deployments receive it through your usual update tooling. Microsoft documents no CVE-specific workaround, registry change, or configuration switch, and the narrow Edit Points trigger is not a vendor-endorsed substitute for installing the update.

Affected systems and versions

Per the MSRC advisory and NVD record, builds below the following versions are vulnerable:

• Microsoft Office LTSC 2024 (32 bit and 64 bit): fixed in 16.0.17932.21140
• Microsoft Office LTSC 2021 (32 bit and 64 bit): fixed in 16.0.14334.21048
• Microsoft Office LTSC for Mac 2024: fixed in 16.115.26110837
• Microsoft Office LTSC for Mac 2021: fixed in 16.115.26110837
• Microsoft Office 365 for Mac: fixed in 16.115.26110837
• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): fixed build varies by channel (see the channel list in the Patch information section)

The vulnerable configuration is any of these products below the fixed build where a user may open untrusted documents for editing and interact with embedded shapes via Edit Points. At the time of writing, the NVD record is marked as awaiting enrichment.

Vendor security history

Microsoft is the assigning CNA and the vendor of the affected product, even though the raw CVE input lists the vendor as unknown. Microsoft's annual report describes Microsoft 365 Commercial as an integrated platform combining Office, Windows, Microsoft 365 Copilot, and Enterprise Mobility + Security, alongside consumer subscriptions and on-premises Office licensing. Its customers range from frontline workers and small businesses to large enterprises and individual consumers, which is why Office advisories tend to be relevant across very different environments.

The most widely cited recent failure on Microsoft's security record is the 2023 Exchange Online intrusion reviewed by the Cyber Safety Review Board. The Board described an espionage actor with ties to the People's Republic of China compromising mailboxes of senior United States government officials and individuals across 22 organizations. It found that Microsoft failed to detect the compromise of its cryptographic assets, relied on a customer to spot the anomalous activity, and had a culture that deprioritized enterprise security investment and rigorous risk management.

In May 2024, Microsoft responded by committing to the Secure Future Initiative, built on security by design, security by default, and secure operations, and by tying part of senior leadership compensation to progress against security milestones. That governance response does not prove technical weaknesses have been eliminated, and the Exchange incident is entirely separate from this Word vulnerability. For CVE-2026-111294, the relevant vendor response is the advisory and the official fix.

References

• MSRC Security Update Guide: CVE-2026-111294, Microsoft Office Word Remote Code Execution Vulnerability
• NVD: CVE-2026-111294
• CVE Record: CVE-2026-111294
• Release notes for Microsoft Office security updates (Microsoft Learn)
• Office Security Releases (aka.ms)
• Release notes for Office for Mac (Microsoft Learn)
• How to update Microsoft 365 or Office for Windows (Microsoft Support)
• BleepingComputer: Microsoft November 2026 Patch Tuesday coverage
• MITRE CWE 122: Heap Based Buffer Overflow
• CISA Known Exploited Vulnerabilities Catalog
• Microsoft 2026 Annual Report
• Prioritizing security above all else (Official Microsoft Blog)
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion