Brief Summary: Microsoft Word CVE-2026-111298 Out-of-Bounds Read Leading to Remote Code Execution

Introduction

A memory safety flaw in Microsoft Word, patched on November 10, 2026, lets an attacker run code as the victim user once that user is persuaded to open and save a pair of crafted files in a particular order. Word sits at the center of document workflows on both Windows and Mac, so the fix for CVE-2026-111298 belongs in every Office patching cycle, even though Microsoft reports no exploitation so far.

Technical information

Root cause

Microsoft classifies the bug as CWE-125, Out-of-Bounds Read. MITRE defines this weakness as reading data past the end, or before the beginning, of the intended buffer. Microsoft ties this instance to unauthorized code execution over a network in Microsoft Office Word.

The public record stops there. Microsoft has not published the vulnerable function, the faulty allocation, the memory layout, or how the invalid read turns into code execution. Office is closed source, so there is no public commit or diff to inspect. The advisory discloses two things: the file-processing sequence needed to trigger the bug, and the possible outcome.

Attack flow

According to the MSRC advisory, the attacker supplies specially crafted files and must persuade a user to do the following:

1. Open an HTML file.
2. Open a Word document in the same running instance of Word.
3. Save that Word document as a web page.

If the sequence succeeds, the attacker's code runs with the permissions of the logged-on user. The attacker does not need an account or prior access to the target system. Microsoft does not claim the bug yields administrator or kernel privileges by itself.

Two details affect how you assess exposure:

• The same-instance requirement is part of the trigger. One running Word process must handle both the HTML file and the Word document. This suggests that state from the first file affects how the second is processed.
• The Preview Pane is not an attack vector. Microsoft states this explicitly. Unlike some earlier Office bugs, passive preview is not enough, and controls that only target the Preview Pane do nothing for this issue.

This is a vendor-described scenario. Microsoft has not named an email campaign, delivery site, document filename, or payload.

Where the bug likely lives (our inference)

The trigger sequence of HTML open, Word document open, and save as web page points to Word's HTML import and export code. Fixes for out-of-bounds reads in parsers like this usually add bounds or length checks before reading from a buffer whose size comes from the parsed file. Another common fix is to stop state carried between documents in one process from being reused after it has become invalid. This is our reading of the bug class, and Microsoft has not confirmed it.

CVSS breakdown

The MSRC advisory publishes this vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• Attack Vector: Network. The issue counts as remotely exploitable in CVSS terms.
• Attack Complexity: Low.
• Privileges Required: None. No account or prior access is needed.
• User Interaction: Required. The open-and-save sequence above must happen first.
• Scope: Unchanged.
• Confidentiality, Integrity, Availability: High. These describe potential impact, not observed damage.
• Exploit Code Maturity: Unproven. Microsoft defines this as no publicly available exploit code, or exploitation that is only theoretical.
• Remediation Level: Official Fix. This is a complete vendor solution, either a patch or an upgrade.
• Report Confidence: Confirmed.

The base score is 8.8 (High) and the temporal score is 7.7. Microsoft's own product severity rating is Important. The two ratings come from different systems and do not conflict. NVD marks the record Awaiting Enrichment, so 8.8 is Microsoft's CNA score, not an independent NIST assessment.

A Network attack vector does not mean the bug can be exploited without user interaction. The user actions above are prerequisites.

Exploitation status at release

• Publicly disclosed: No
• Exploited: No
• Exploitability assessment: Exploitation Less Likely
• CISA KEV: Not present in the catalog snapshot dated November 10, 2026
• Attribution: No threat actor, campaign, malware family, or indicator set is linked to this CVE in the reviewed material

What the evidence supports is no reported active exploitation at release. That does not prove exploitation is impossible.

Patch information

Microsoft fixed CVE-2026-111298 in the November 10, 2026 Patch Tuesday release. The advisory was published at revision 1.0, and credit goes to Jeongmin Choi (@lmksecurity).

How the fix ships

The fix comes only as updated Office builds. Word does not get a separate patch. Its changes ship inside the normal Office cumulative update. Microsoft's Release notes for Microsoft Office security updates page lists CVE-2026-111298 in the Office suite section of the November 10, 2026 release. Dozens of other Word CVEs fixed in the same cycle appear alongside it, including CVE-2026-111299, CVE-2026-111302, and CVE-2026-111304.

First fixed builds

These builds come from the MSRC advisory and NVD's CNA data:

• Office LTSC 2024 (32-bit and 64-bit): 16.0.17932.21140 (Version 2408)
• Office LTSC 2021 (32-bit and 64-bit): 16.0.14334.21048 (Version 2108)
• Microsoft Office 365 for Mac: 16.115.26110837
• Office LTSC for Mac 2021 and 2024: 16.115.26110837
• Microsoft 365 Apps for Enterprise (32-bit and 64-bit): fixed per channel, listed below

The advisory does not give one build number for Microsoft 365 Apps for Enterprise. Each servicing channel has its own build, so the advisory points to the Office security release notes instead. The November 10, 2026 release notes list these fixed builds:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office 2024 Retail and Office 2021 Retail: Version 2610 (Build 20527.20196)

Verifying and deploying

To confirm a machine is patched, compare its installed Office build with the numbers above:

• Windows: go to File > Account > About.
• Mac: open the app's About dialog.

For Mac installs from outside the Mac App Store, Microsoft's support guidance says:

1. Open a Microsoft 365 app such as Word.
2. Select Help > Check for Updates.
3. Select Update.
4. Turn on Automatically keep Microsoft apps up to date to receive future fixes.

For Mac App Store installs, open the App Store, select Updates, then choose Update All or the button next to the app.

Running an update check does not, by itself, show which build was installed, so confirm the resulting build number. Microsoft has published no vulnerability-specific workaround such as a registry change or file association change. The official update is the supported remediation.

Affected systems and versions

In NVD's affected product data, each listed product is vulnerable up to, but not including, the build shown:

• Microsoft 365 Apps for Enterprise: from 16.0.1. The upper bound points to Microsoft's Office security releases resource rather than a numeric version, because fixed builds vary by channel (see above).
• Microsoft Office 365 for Mac: from 1.0.0 up to, but not including, 16.115.26110837
• Microsoft Office LTSC 2021: from 16.0.1 up to, but not including, 16.0.14334.21048
• Microsoft Office LTSC 2024: from 16.0.0 up to, but not including, 16.0.17932.21140
• Microsoft Office LTSC for Mac 2021: from 16.0.1 up to, but not including, 16.115.26110837
• Microsoft Office LTSC for Mac 2024: from 16.0.0 up to, but not including, 16.115.26110837

The documented trigger requires a user to open a crafted HTML file and then a Word document in the same running Word instance, and then save the document as a web page. Preview Pane rendering alone is not a documented trigger.

Vendor security history

Microsoft is both the CNA and the affected vendor. Some market context helps explain why Word bugs matter operationally. The UK Competition and Markets Authority, citing its 2025 Cloud Market Investigation, recorded Microsoft holding an 80% to 90% share band of global productivity suites in 2022 and several preceding years. On May 14, 2026, it opened an initial Strategic Market Status investigation into Microsoft's business software ecosystem, including Word. That notice announces an investigation, not a final finding.

On security governance, the Cyber Safety Review Board examined the Summer 2023 Exchange Online intrusion by an actor assessed to be affiliated with the People's Republic of China. The Board found the intrusion preventable and cited decisions that deprioritized enterprise security investment and rigorous risk management. In June 2024, Microsoft said it was acting on all 16 applicable CSRB recommendations and expanded its Secure Future Initiative. Its July 2026 progress report describes a multiagent system that assesses cloud source code, identity configurations, network topology, and runtime state for composite vulnerabilities.

None of this history is connected to CVE-2026-111298. It is accountability context only. The evidence for acting on this CVE is the advisory, the affected product record, and the fixed builds above.

References

• Microsoft Security Update Guide: CVE-2026-111298, Microsoft Office Word Remote Code Execution Vulnerability
• NVD entry for CVE-2026-111298
• CVE Record for CVE-2026-111298
• Release notes for Microsoft Office security updates (Microsoft Learn)
• Office security releases resource referenced by the advisory
• MITRE CWE 125: Out of Bounds Read
• CISA Known Exploited Vulnerabilities catalog feed
• Update Office for Mac automatically (Microsoft Support)
• Allow Microsoft AutoUpdate to run in the background on macOS (Microsoft Support)
• Upgrade macOS to continue receiving Microsoft 365 and Office for Mac updates (Microsoft Support)
• Update history for Microsoft 365 Apps by date (Microsoft Learn)
• Update history for Office for Mac (Microsoft Learn)
• DHS: Cyber Safety Review Board report on the Microsoft Online Exchange incident
• Microsoft On the Issues: Microsoft's work to strengthen cybersecurity protection
• Microsoft Security Blog: July 2026 progress report on the Secure Future Initiative
• UK CMA Investigation Notice