Quick Look: Microsoft Word CVE-2026-111295 Heap Buffer Overflow and Its Legacy Save Path to Code Execution

Introduction

A heap buffer overflow fixed in Microsoft Word during the November 10, 2026 Patch Tuesday release can give an attacker code execution with the permissions of whichever user processes a crafted document. For prioritization, Microsoft's documented scenario requires the victim to both open the file and then save it in the legacy Word 97 to 2003 format. That makes CVE-2026-111295 serious but dependent on user interaction. It is not an unattended network compromise.

The NVD summary lists the vendor as Unknown. The affected vendor is Microsoft, which is also the assigning CNA for this CVE.

Technical information

Root cause classification

Microsoft and NVD classify the weakness as CWE-122, Heap Based Buffer Overflow. MITRE defines this as a buffer overflow where the overwritten memory was allocated on the heap, typically through a routine such as malloc(). That definition describes the weakness class only. It does not tell us which allocator or code path Word uses here.

Microsoft's FAQ ties the bug to a specific workflow: a user opens a specially crafted document and then saves it in Word 97 to 2003 format. That points to the legacy binary (.doc) serialization path, where Word converts its in-memory document representation into the older file structures. Because the save step is part of the trigger, the overflow most plausibly occurs while Word is writing out those legacy structures rather than during initial parsing, although Microsoft has not said so explicitly.

Office is closed source, so there is no public commit or diff, and Microsoft has not described what changed. Heap overflows of this class are usually fixed by validating computed lengths and counts against the size of the allocated heap buffer before copying. Treat that as inference about the bug class, not a vendor statement.

Reading the CVSS vector correctly

Microsoft publishes the following CVSS 3.1 vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

The base metrics (network vector, low complexity, no privileges, user interaction required, unchanged scope, high confidentiality, integrity, and availability impact) produce a base score of 8.8. The temporal metrics (exploit maturity Unproven, remediation level Official Fix, report confidence Confirmed) bring the temporal score to 7.7.

Two points about the vector are easy to miss:

• AV:N does not mean zero-click. The network vector reflects how the malicious document reaches the victim. UI:R is the operative constraint, and nothing happens unless the user acts on the file.
• The impact is bounded by the user's permissions. The public description says an unauthorized attacker can execute code over a network, but Microsoft's FAQ narrows the outcome to execution with the user's permissions. No separate privilege escalation is described.

Microsoft also states plainly that the Preview Pane is not an attack vector, so previewing the file in Outlook or Explorer is not part of the documented scenario.

Attack flow

Based solely on Microsoft's FAQ, the documented sequence is:

1. The attacker prepares a specially crafted Word document. No account on the target system is required.
2. The document is delivered to the victim. The reviewed sources do not identify a particular delivery channel.
3. The attacker persuades the user to open the document in Word.
4. The user saves the document in Word 97 to 2003 format, exercising the legacy save path where the heap overflow occurs.
5. On successful exploitation, attacker-controlled code runs with the permissions of that user.

Describing this as execution upon receiving or opening a document would omit a material prerequisite. The save in legacy format is part of the documented trigger.

What is not public

The advisory and CVE record do not disclose a vulnerable function name, an overwrite length, a heap layout, a working payload, or a patch diff. No reproducible exploit can be derived from the public description, and our analysis stops at the classification, the open and save workflow, and the stated execution outcome.

Exploitation status

For the November 10, 2026 advisory, Microsoft records Publicly Disclosed: No, Exploited: No, Exploitation Less Likely, and exploit code maturity Unproven. CISA's SSVC entry in the CVE record, timestamped the same day, records exploitation: none, automatable: no, and technical impact: total.

Zero Day Initiative's November review lists this CVE as Important, CVSS 8.8, not publicly disclosed and not exploited, matching MSRC. No reviewed source names a threat actor, malware family, campaign, or public proof of concept for this CVE. That reflects the available reporting, not proof that no private exploit exists.

Patch information

Microsoft fixed CVE-2026-111295 in its November 10, 2026 Patch Tuesday release. The temporal vector's RL:O (Remediation Level: Official Fix) indicates Microsoft considers the shipped update a complete fix. The advisory lists no workaround or hotfix stage before it.

Fixed builds

The MSRC Security Update Guide and the CNA data on NVD agree on these patched versions:

Microsoft 365 Apps has no single build number because each update channel (Current, Monthly Enterprise, Semi Annual) receives its own fixed build. Microsoft points to the Office security release index for the build matching your channel, and NVD records the affected range for this product the same way, with that link as the upper bound.

Delivery

• Windows (LTSC 2021/2024, Microsoft 365 Apps): The fix ships through the normal Office update channels (Click to Run). Microsoft lists its Microsoft 365 Apps security updates release notes as the KB article for each SKU.
• macOS (Office 365 for Mac, LTSC for Mac 2021/2024): All three Mac SKUs share one fixed build, 16.115.26110837, documented in the Release notes for Office for Mac. The Mac apps share a common codebase, so one build fixes every Mac SKU.

Microsoft's documented update procedures:

• Windows: In Word, create a new document and select File > Account > Update Options > Update Now, selecting Enable Updates first if needed. If Update Options is missing and only About appears, the install is likely managed through volume licensing or Group Policy. In that case, use Microsoft Update or contact your help desk.
• Mac: In Word, select Help > Check for Updates, then Update. Microsoft also offers Automatically keep Microsoft apps up to date. Mac App Store installs update through the store's Updates page.

Verifying the fix

In any Office app, open File > Account > About (Windows) or Word > About Word (Mac). If the build is at or above the threshold in the table, the fix is present. Microsoft 365 Apps users should compare their build against the channel-specific entry at the Office security release index.

Context

This is one of roughly 65 Word CVEs in a very large November release, per ZDI's monthly tally. The cumulative Office update fixes all of them together, so you cannot install a fix for this CVE alone. Reaching the fixed build brings in every fix in that month's Word set. No CVE-specific workaround, such as a macro or document policy change, is documented, so the update is the supported remediation.

Affected systems and versions

Microsoft's CVE record lists the following affected ranges. Upper boundaries are exclusive, so versions below them are affected.

The Windows LTSC 2021 and LTSC 2024 boundaries differ, while all listed Mac editions share a single upper boundary. The vulnerable configuration is any of these builds where a user can open a crafted document and save it in Word 97 to 2003 format.

Vendor security history

Microsoft's Office footprint spans commercial and consumer offerings, per its 2026 annual report, and this CVE touches several deployment models at once: subscription Microsoft 365 Apps and perpetual Office LTSC on both Windows and Mac.

The most significant independent assessment of Microsoft's security practices in the reviewed material is the Cyber Safety Review Board's report on the summer 2023 Exchange Online intrusion. The Board concluded the intrusion was preventable and should never have occurred, found Microsoft's security culture inadequate, and called for an overhaul with direct attention from the CEO and board and a public reform plan with specific timelines. That incident involved the actor's use of an invalid signing key to authenticate requests. It was a cloud authentication failure with no technical or attribution link to this Word heap overflow.

Microsoft's response is its Secure Future Initiative. In the July 2026 progress report, Microsoft states that three objectives reached their target state, three were nearing completion, and twelve made significant progress, alongside changes to engineering practices, training, governance, and accountability. These are Microsoft's own statements and do not establish anything about how this particular Word bug was introduced or fixed.

References

• NVD entry for CVE-2026-111295
• CVE.org record for CVE-2026-111295
• Microsoft Security Update Guide: CVE-2026-111295
• CVE Services API record (affected version ranges and CISA SSVC)
• Release notes for Microsoft Office security updates
• Zero Day Initiative: The November 2026 Security Update Review (thezdi.com)
• Zero Day Initiative: The November 2026 Security Update Review (zerodayinitiative.com)
• MITRE CWE-122: Heap Based Buffer Overflow
• Microsoft Support: How to update Microsoft 365 or Office for Windows
• Microsoft Support: Update Office for Mac automatically
• BleepingComputer: Microsoft November 2026 Patch Tuesday coverage
• Microsoft 2026 Annual Report
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft Secure Future Initiative Progress Report, July 2026