Introduction
A specially crafted Word document, combined with one specific formatting action by the person who opens it, is enough to corrupt heap memory in Microsoft Word and run attacker-supplied code under that user's account. Microsoft fixed the flaw, tracked as CVE-2026-111299, in its November 10, 2026 Patch Tuesday release. The affected list covers Microsoft 365 Apps for Enterprise, Office 365 for Mac, and the Windows and Mac editions of Office LTSC 2021 and 2024.
Microsoft scores the issue at CVSS 3.1 8.8 (High) and rates it Important in its own severity system. The two ratings come from different schemes, so they do not conflict. At release, Microsoft recorded the bug as not publicly disclosed, not exploited, and Exploitation Less Likely, and the Zero Day Initiative's November 2026 review also lists it as not exploited. It was one of dozens of Word remote code execution bugs fixed that month. This post summarizes what the public record establishes, and where that record stops.
Technical Information
Root cause
Microsoft classifies the bug as CWE-122, Heap based Buffer Overflow. MITRE defines this as a buffer overflow where the overwritten buffer was allocated in the heap portion of memory. Microsoft describes the consequence as remote code execution in Word.
Microsoft has not published root cause details. The public material does not identify the vulnerable function, the overwrite length, the heap layout, or the exploitation primitive. The advisory FAQ does describe the trigger, which is a crafted Word document in which the user applies a gradient text fill to an embedded shape.
That trigger tells us roughly where the patched code sits. It points to the rendering or formatting logic that builds gradient fill data (such as gradient stops or color arrays) for text inside embedded shape objects. Values taken from the document appear to control how much data gets written into a heap buffer. With heap overflows of this kind, a fix usually validates attacker-controlled sizes or counts against the real allocation size before copying, or sizes the allocation from validated values. This is an inference, and Microsoft has not confirmed it. Word is closed source, so there is no public commit or diff to check it against.
Scoring breakdown
Microsoft's published vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Attack Vector: Network. The malicious document can be delivered remotely.
- Attack Complexity: Low.
- Privileges Required: None. The attacker needs no account on the target system.
- User Interaction: Required. Network delivery and no privileges do not make this interactionless.
- Scope: Unchanged.
- Confidentiality, Integrity, Availability: High. Code runs with the affected user's permissions. Nothing in the advisory implies administrator rights.
- Temporal (E:U/RL:O/RC:C): unproven exploit maturity, official fix, confirmed report. This brings the temporal score to 7.7 against the 8.8 base.
Attack flow
Based on Microsoft's documented scenario:
- The attacker prepares a specially crafted Word document containing an embedded shape.
- The attacker gets the document to the target and convinces the user to open it.
- The user applies a gradient text fill to the embedded shape.
- Word's gradient fill handling writes past the bounds of a heap buffer.
- On successful exploitation, attacker code runs with the permissions of the user.
Keep a few limits in mind when you communicate this internally. Microsoft explicitly states that the Preview Pane is not an attack vector, so previewing the file alone is not described as sufficient. The advisory also does not establish a macro requirement, a particular file extension, or an email-only delivery path. The required user action goes beyond simply opening the file, which is consistent with the SSVC automatable value of no.
Exploitation status at release
- Microsoft: Publicly Disclosed: No. Exploited: No. Exploitation Less Likely.
- Zero Day Initiative: Important, CVSS 8.8, Deployment Priority 2, no exploitation or prior public knowledge indicated.
- CISA Coordinator SSVC (in the NVD record): exploitation none, automatable no, technical impact total.
- Attribution: no threat actor is identified for this CVE, and no CVE-specific hashes, domains, or signatures were found in the reviewed material.
These assessments were made at release and do not guarantee anything about future activity. A technical impact rating of total describes the potential consequence. It does not report an observed intrusion.
Patch Information
Microsoft fixed CVE-2026-111299 on November 10, 2026. The fix is delivered as updated Office builds. The Security Update Guide sets the CVSS Remediation Level to RL:O (Official Fix), which Microsoft defines as "A complete vendor solution is available." Because the fix is in Word's own code, protection means installing the new Office build. No separate component or registry setting needs to change, and the advisory does not specify a workaround.
Fixed builds (MSRC advisory)
- Microsoft Office LTSC 2021 (32-bit and 64-bit): 16.0.14334.21048
- Microsoft Office LTSC 2024 (32-bit and 64-bit): 16.0.17932.21140
- Microsoft Office LTSC for Mac 2021 and 2024: 16.115.26110837
- Microsoft Office 365 for Mac: 16.115.26110837
- Microsoft 365 Apps for Enterprise (32-bit and 64-bit): set per channel (see aka.ms/OfficeSecurityReleases)
NVD lists the same values as the exclusive upper bounds of the affected ranges, so any build below them is vulnerable.
Click to Run channel builds
Microsoft 365 Apps updates by channel rather than through a single build number. Microsoft's Office security release notes for November 10, 2026 list CVE-2026-111299 under Word. The builds below were extracted from that page automatically, so verify them against the page before relying on them:
- Current Channel: Version 2610 (Build 20527.20196)
- Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
- Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
- Office 2024 and 2021 Retail: Version 2610 (Build 20527.20196)
- Office LTSC 2024 Volume Licensed: Version 2408 (Build 17932.21140)
- Office LTSC 2021 Volume Licensed: Version 2108 (Build 14334.21048)
The two LTSC volume-licensed builds match the MSRC table exactly, which suggests the channel mapping is consistent.
Verifying the fix
- Windows: open File > Account > About Word and compare the build with the list above for your channel.
- macOS: open Word > About Word and confirm the version is at least 16.115 (26110837).
Click to Run installs usually update themselves in the background. Managed environments that hold back channel updates (WSUS/ConfigMgr, Intune update rings, or deferred Semi Annual channels) should confirm that the November builds have actually reached endpoints. Until a machine runs a build at or above these values, it still contains the vulnerable gradient fill code.
Advisory metadata
The advisory is at revision 1.0, published November 10, 2026. The bug was reported through coordinated disclosure by Jeongmin Choi (@lmksecurity).
Affected Systems and Versions
From the Microsoft-supplied CVE and NVD records (upper bounds are exclusive):
- Microsoft 365 Apps for Enterprise (Windows 32-bit and x64): from 16.0.1. The upper boundary references Office Security Releases rather than a numeric build.
- Microsoft Office 365 for Mac: from 1.0.0, before 16.115.26110837.
- Microsoft Office LTSC 2021 (Windows 32-bit and x64): from 16.0.1, before 16.0.14334.21048.
- Microsoft Office LTSC 2024 (Windows 32-bit and x64): from 16.0.0, before 16.0.17932.21140.
- Microsoft Office LTSC for Mac 2021: from 16.0.1, before 16.115.26110837.
- Microsoft Office LTSC for Mac 2024: from 16.0.0, before 16.115.26110837.
Do not apply a Windows LTSC build threshold to a Mac or subscription installation. Each product group has its own boundary. The retrieved affected product list does not establish exposure for Word on the web or mobile editions.
Vendor Security History
Office documents have been used in real attacks before. Microsoft reported that Storm-0978 targeted defense and government organizations in Europe and North America using Word documents and Ukrainian World Congress-themed lures. The group exploited CVE-2023-36884 before it was disclosed to Microsoft and delivered a backdoor with similarities to RomCom. Microsoft released security updates on August 8, 2023 that superseded the earlier mitigations. That case is historical context only. Nothing in the reviewed sources connects Storm-0978 or RomCom to CVE-2026-111299.
On the program side, Microsoft's July 2026 Secure Future Initiative report describes three objectives at target state, three nearing completion, and twelve with significant progress. It also gives vendor-reported figures such as 99.97% phishing-resistant MFA coverage, 98.7% cross-boundary credential isolation, removal of public access from 732,000 resources, and more than 100 new detections. These are program-level outcomes and say nothing about whether a given Word installation is patched.
References
- NVD entry for CVE-2026-111299
- CVE.org record for CVE-2026-111299
- Microsoft Security Update Guide: CVE-2026-111299
- Microsoft 365 Apps security updates release notes
- BleepingComputer: Microsoft November 2026 Patch Tuesday coverage
- Zero Day Initiative: The November 2026 Security Update Review
- NVD API record for CVE-2026-111299
- MITRE CWE-122: Heap based Buffer Overflow
- Microsoft Security Blog: Storm-0978 attacks reveal financial and espionage motives
- Microsoft Secure Future Initiative Progress Report, July 2026
- Microsoft Word product page
- Microsoft 365 Enterprise
