Brief Summary: Microsoft Word CVE-2026-111304 Use After Free Leading to Code Execution

Introduction

A use after free in Microsoft Word, fixed in Microsoft's November 10, 2026 Office security release, can lead to code execution with the permissions of the user who works with a crafted document. Because Word sits at the center of document workflows in most organizations, CVE-2026-111304 deserves a place in this month's patch cycle, even though Microsoft's own advisory describes a narrower and more interactive trigger than the "network code execution" headline suggests.

Some upstream results confuse this CVE with CVE-2026-11304 (one digit fewer), which is a separate Chromium/PDFium use after free fixed in Chrome 149.0.7827.53. Claims that the Word bug was a Chrome zero day, or that it was patched in Chrome or Mariner, come from that mix-up. CVE-2026-111304 is a Microsoft Office Word use after free (CWE 416), with Microsoft as the CNA.

Technical information

Root cause: CWE 416 use after free

MITRE defines use after free as reusing or referencing memory after it has been freed. Once freed, that memory may be allocated to a different object while an original pointer still refers to it, so any operation performed through the stale pointer acts on memory the code no longer owns. In practice this class of bug is a common route from a memory safety defect to controlled code execution.

Microsoft's advisory confirms the weakness class and the triggering workflow, but it does not identify the specific Word object, parser, function or allocation involved. Word is closed source, and no root cause write-up or code diff has been published.

The documented attack flow

Microsoft's FAQ is unusually specific about how exploitation works. Based on the advisory, the sequence is:

1. The attacker creates a specially crafted Word document.
2. The attacker delivers it to the target over a network (the reason for the AV:N rating).
3. The attacker convinces the user to open the document in Word.
4. The user inserts a page break.
5. The user saves the document.
6. The user closes the document.
7. If exploitation succeeds, code executes with the permissions of that user. The attacker does not need an account on the system.

For exposure assessment, Microsoft explicitly states that the Preview Pane is not an attack vector, so this is not a preview-based or interaction-free bug. Simply receiving or opening the file is not described as sufficient either. The documented workflow includes editing, saving and closing. Network-reachable delivery and required user participation coexist here, and describing the issue only as "network RCE" drops the most consequential prerequisite.

The impact is code execution in the context of the current user. The advisory does not describe a privilege escalation to administrative rights.

What the fix most likely changed (inference)

Microsoft has not published a root cause, so the following is inference, not confirmed behavior. The trigger path (open, page break, save, close) points toward object lifetime problems in Word's pagination or layout code during save and teardown, where a document object appears to be freed during layout recalculation or close while another component still holds a stale pointer to it. Fixes for this kind of bug usually take one of three forms:

• Making ownership explicit, using reference-counted or owning handles instead of raw pointers.
• Clearing or invalidating cached pointers when the object is destroyed.
• Reordering teardown so dependent structures are released before the object they point to.

Whichever approach Microsoft used lives in the shipped binaries, not public source.

CVSS breakdown

Microsoft's base vector, reproduced by NVD:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector: Network. Delivery happens remotely.
• Attack Complexity: Low. This is assessed separately from user participation; low complexity does not mean no user action is needed.
• Privileges Required: None. No attacker account is required.
• User Interaction: Required. The open, page break, save and close workflow.
• Scope: Unchanged.
• Confidentiality, Integrity, Availability: High. These describe potential impact, not observed outcomes.

Microsoft also publishes temporal metrics E:U/RL:O/RC:C, producing a temporal score of 7.7: exploit maturity Unproven, remediation level Official Fix, report confidence Confirmed. "Confirmed" refers to confidence in the vulnerability report, not confirmation of active exploitation. Microsoft's product severity rating is Important, which is a separate scale from the CVSS High rating. NVD lists the record as Awaiting Enrichment, so the 8.8 score is Microsoft's CNA assessment rather than an independent NIST score.

Exploitation status

• Microsoft at publication: Publicly disclosed: No, Exploited: No, Exploitation Less Likely.
• The isMalicious tracker reports no confirmed exploitation, and lists no Nuclei template, Exploit DB entry or Metasploit module.
• According to the same tracker, the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
• No threat actor, campaign, victim or indicators have been tied to this CVE. The acknowledgement identifier 0ccbbf129444eb66344ccafb92b00df4 in Microsoft's advisory is a researcher credit, not attacker attribution.

The absence of reported exploitation is a statement about available reporting at a point in time, not proof that none has occurred, and it does not make patching optional.

Patch information

Microsoft released an official fix in its November 10, 2026 Office security release. Because Word is closed source, there is no public commit or diff. The fix ships only as updated Office builds. The advisory lists a single revision, 1.0 ("Information published") on November 10, 2026, with no later release or fix change recorded. Microsoft documents no separate workaround, so moving to the builds below is the only remediation.

Windows (Microsoft 365 Apps, Click to Run)

Microsoft's Release notes for Microsoft Office security updates list CVE-2026-111304 in the Word section of the November 10, 2026 release. These are the first builds containing the fix:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel (receives Monthly Enterprise builds): Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)

The same release note entry also gives November builds for Office 2024/2021 Retail and the LTSC/2019 volume-licensed editions. However, the CVE's own advisory lists only Microsoft 365 Apps for Enterprise (32 bit and 64 bit) and the Mac products as affected. Treat the MSRC product table as the authoritative scope for this CVE.

To update, Microsoft documents opening any Microsoft 365 application and selecting File > Account > Update Options > Update Now (select Enable Updates first if needed). If Update Options is missing, the installation may be volume licensed or managed through Group Policy, in which case updates come through Microsoft Update or your organization's management tooling.

macOS

The Office for Mac release notes for November 10, 2026, Version 16.115 (Build 26110837) list CVE-2026-111304 under Security updates, Word. The update is delivered through Microsoft AutoUpdate (MAU). Users can trigger it via Help > Check for Updates and then Update or Update All, and apps installed from the Mac App Store update through that store. For managed fleets, Microsoft's administrator documentation notes that Mac Office updates ship as updated application bundles rather than individually downloadable security fixes, and administrators can deploy them through software distribution tools and set installation deadlines.

Office for Mac updates now require macOS 14 (Sonoma) or later, so machines on older macOS versions will not receive this fix even though Word still runs on them.

Confirming you are patched

• Windows: In Word, open File > Account > About Word and compare the build with your channel's fixed build above. Equal or higher means the fix is present.
• macOS: Open Word > About Word and check for 16.115 (26110837) or later.
• Fleet wide: Patch management or inventory tools should check against the same thresholds. Microsoft 365 Apps updates are cumulative, so any later build also contains this fix.

Affected systems and versions

Affected products per MSRC, with ranges as recorded by NVD:

• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): from 16.0.1; NVD's upper boundary points to Microsoft's channel release list (aka.ms/OfficeSecurityReleases) rather than a single version. Fixed in the channel-specific builds listed above.
• Microsoft Office 365 for Mac: from 1.0.0, below 16.115.26110837.
• Microsoft Office LTSC for Mac 2021: from 16.0.1, below 16.115.26110837.
• Microsoft Office LTSC for Mac 2024: from 16.0.0, below 16.115.26110837.

All three Mac products are fixed in 16.115.26110837. Two configuration notes apply:

• Mac systems running macOS versions older than macOS 14 cannot receive the fixed build and should be treated as remaining exposed.
• The research briefing we worked from noted that the Office for Mac update history page reviewed at the time did not list 16.115, even though the Mac release notes do. Rather than treating "an update check completed" as evidence of remediation, verify the actual installed build against 16.115 (26110837).

Vendor security history

Microsoft's position in business software makes Word a significant organizational dependency. In an October 16, 2026 announcement, the UK Competition and Markets Authority described Microsoft's strong position across productivity suites and other business software, citing switching barriers, commercial practices and integration advantages. Its proposed strategic market status designation was still subject to consultation at that point.

The most prominent independent assessment of Microsoft's security practices is the Cyber Safety Review Board's review of the summer 2023 Exchange Online intrusion by Storm-0558, assessed as affiliated with the People's Republic of China. The Board considered the intrusion preventable and found that operational and strategic decisions indicated a culture that had deprioritized enterprise security investment and rigorous risk management. It recommended a public reform plan with timelines and leadership accountability, and suggested considering a lower priority for feature development until substantial security improvements were made.

In June 2024 testimony, Microsoft accepted responsibility for the issues the Board identified, described the Secure Future Initiative, placed overall security accountability with CEO Satya Nadella and tied part of senior leadership compensation to security progress. That is a change in governance and incentives, not proof that individual engineering weaknesses have been eliminated. None of the reviewed sources connect Storm-0558 or the Exchange Online incident to CVE-2026-111304. This history is supplier context, not a root cause for the Word bug.

References

• Microsoft Security Update Guide: CVE-2026-111304
• NVD: CVE-2026-111304
• CVE Record: CVE-2026-111304
• Release notes for Microsoft Office security updates
• Release notes for Office for Mac
• Update history for Office for Mac
• MITRE CWE 416: Use After Free
• How to update Microsoft 365 or Office for Windows
• Update Office for Mac automatically
• Deploy updates for Office for Mac
• isMalicious: CVE-2026-111304
• CISA Known Exploited Vulnerabilities Catalog
• CISA KEV JSON feed
• DHS: Cyber Safety Review Board report on the Microsoft Online Exchange incident
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft On the Issues: Microsoft's work to strengthen cybersecurity protection
• Microsoft Secure Future Initiative April 2025 progress report
• GOV.UK: CMA takes first steps to ensure choice in business software
• Zero Day Initiative: The November 2026 Security Update Review
• BleepingComputer: Microsoft November 2026 Patch Tuesday coverage