Introduction
A single crafted document, once opened in Microsoft Word, is what it takes to reach the heap memory corruption behind CVE-2026-111306, a flaw Microsoft scores 8.8 on CVSS v3.1 with high confidentiality, integrity, and availability impact. The affected code ships in Microsoft 365 Apps, Office LTSC, and Office for Mac, so the November 10, 2026 fix has to land on both Windows and Mac fleets, each on its own build line.
Microsoft rates the issue Important on its own product severity scale, while the CVSS base score falls in the High band. We keep both labels in this post rather than describing it as Critical. At publication, Microsoft reports no exploitation and no prior public disclosure.
Technical information
Root cause
Microsoft classifies the bug as CWE-122, heap-based buffer overflow. MITRE defines this as a buffer overflow where the overwritten buffer is allocated in the heap portion of memory. Microsoft's description states that the overflow in Word "allows an unauthorized attacker to execute code over a network."
That CWE tells us the class of memory corruption, not the location. Word is closed source, there is no public commit or diff, and Microsoft has not said which parser, file format, or code path changed. Heap overflows in document parsers are commonly fixed by checking a length or size read from the file against the real heap allocation before copying data. That is background on the bug class, not a confirmed description of this patch.
Reading the CVSS vector
Microsoft publishes the following base vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack Vector: Network. The attacker operates in a remote context.
- Attack Complexity: Low. No specialized access conditions or extenuating circumstances.
- Privileges Required: None. The attacker needs no prior authorization.
- User Interaction: Required. A user must act before exploitation is possible.
- Scope: Unchanged. Impact stays within resources managed by the same security authority.
- Confidentiality, Integrity, Availability: High. Potential total loss of each within the impacted component.
The temporal score is 7.7, built from E:U (unproven exploit maturity), RL:O (official fix), and RC:C (confirmed report confidence). The lower temporal score does not change the base rating, and it does not mean any particular installation is safe.
Attack flow
Based on what Microsoft has published, the documented attack looks like this:
- The attacker prepares a specially crafted file intended to trigger the heap overflow when Word processes it.
- The attacker supplies the file to a target. The attack vector is network and no privileges are required. The advisory does not specify a delivery channel.
- A user opens the file in Word. This is the required user interaction. Microsoft explicitly states that the Preview Pane is not an attack vector, so the documented trigger is opening the file, not previewing it.
- Processing the file overflows a heap buffer, which according to Microsoft can allow the attacker to execute code, with high potential impact to confidentiality, integrity, and availability.
What the advisory does not tell us
The public material does not disclose the affected parser, the exact file format, whether macros are involved, how Protected View behaves, or any reproducible exploitation procedure. We therefore cannot support claims about a detailed exploit chain or a bypass of specific Office protections. The confirmed facts are the bug class, the file-opening trigger, the Preview Pane exclusion, and the impact ratings.
Exploitability status at publication
Microsoft frames its exploitability data as an assessment at original publication:
- Publicly disclosed: No
- Exploited: No
- Exploitability assessment: Exploitation Less Likely
- Exploit code maturity: Unproven
- Acknowledgement: Anonymous (this is not attacker attribution)
The advisory names no threat actor, campaign, or indicators of compromise. The RC:C factor confirms the vulnerability report, not an attack campaign. For contrast, November 2026 Patch Tuesday coverage from BleepingComputer highlights an actively exploited Outlook spoofing flaw, CVE-2026-124194, involving NTLM hash theft. That is a different product and identifier, and it says nothing about exploitation of this Word bug.
Patch information
Microsoft fixed CVE-2026-111306 in its November 10, 2026 security release. The MSRC Security Update Guide sets the Remediation Level to Official Fix, defined as "A complete vendor solution is available," and lists a security update for all nine affected product rows. The fix ships only as updated Office binaries.
Fixed builds
The most reliable way to confirm a machine is patched is to compare its Office build with the fixed builds below. MSRC and the CNA data in NVD treat any lower build as affected.
- Microsoft Office 365 for Mac: 16.115.26110837 (see Office for Mac release notes)
- Microsoft Office LTSC for Mac 2021: 16.115.26110837
- Microsoft Office LTSC for Mac 2024: 16.115.26110837
- Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140 (see Microsoft 365 Apps security updates)
- Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048
- Microsoft 365 Apps for Enterprise (32 bit and 64 bit): depends on update channel (see Office Security Releases)
Notes on the fixed builds
- The Mac subscription and both perpetual LTSC Mac editions share fixed build 16.115.26110837, since the same Word code is serviced across all three.
- Microsoft 365 Apps for Enterprise has no single fixed build. It is serviced through several channels (Current, Monthly Enterprise, Semi Annual Enterprise, and others), each with its own patched build number. Check the installed build against the November 2026 entry for the channel the machine uses.
- Office LTSC 2021 and 2024 are fixed on their own servicing branches (16.0.14334.x and 16.0.17932.x), with one fixed build per edition covering both 32-bit and 64-bit installs. Windows LTSC builds are not interchangeable with the Mac build.
Deploying the update
On Windows installations that expose the standard controls, Microsoft's guidance is to open an Office application such as Word, create a document, and select File > Account > Update Options > Update Now, selecting Enable Updates first if needed. If Update Options is missing and only About appears, updates are likely controlled by volume licensing or organizational Group Policy. In that case, use Microsoft Update or contact the help desk.
On Mac, updates are delivered through Microsoft AutoUpdate or administrator-managed software distribution. Mac updates replace the application bundle (for example, Word) with an updated bundle. Individual security fixes cannot be downloaded and installed on their own, so the application update is the deployment unit.
Advisory status and limitations
The MSRC advisory is at revision 1.0 ("Information published," November 10, 2026). Microsoft has not posted a revised or reissued update, so the November 10 builds are the current fix. The advisory lists no separate workaround or CVE-specific mitigation. When the briefing for this post was compiled, the Office security release notes page did not yet show a November entry for this CVE, even though the advisory itself lists the corrected builds.
Affected systems and versions
Per the CVE record in NVD and the MSRC advisory:
- Microsoft 365 Apps for Enterprise (32 bit and 64 bit): from 16.0.1 up to the applicable channel security release listed at Office Security Releases
- Microsoft Office LTSC 2021 (32 bit and 64 bit): from 16.0.1, before 16.0.14334.21048
- Microsoft Office LTSC 2024 (32 bit and 64 bit): from 16.0.0, before 16.0.17932.21140
- Microsoft Office 365 for Mac: from 1.0.0, before 16.115.26110837
- Microsoft Office LTSC for Mac 2021: from 16.0.1, before 16.115.26110837
- Microsoft Office LTSC for Mac 2024: from 16.0.0, before 16.115.26110837
The record does not specify architecture for the Mac products.
Vendor security history
Microsoft's broader record includes both documented failures and reported remediation work. The Cyber Safety Review Board's review of the Summer 2023 Exchange Online intrusion found that Storm-0558, associated with the government of the People's Republic of China, accessed senior United States officials' email accounts. The Board concluded that the intrusion was preventable and that Microsoft's security culture was inadequate and required an overhaul. It pointed to key management and key rotation failures that left an older signing key usable, and to reliance on a customer to spot anomalies.
In its July 2026 Secure Future Initiative progress report, Microsoft describes work on stronger authentication, network isolation, credential isolation, removal of unused applications, and proactive vulnerability detection, while acknowledging the work is unfinished and needs continuous validation.
Neither item bears directly on this CVE. The Exchange incident does not indicate that Storm-0558 exploited this Word flaw or that the root causes are related, and the initiative's progress is not evidence that Word is free of memory corruption bugs. For CVE-2026-111306, the concrete assurance is the product-specific fix.
References
- NVD: CVE-2026-111306
- CVE Record: CVE-2026-111306
- Microsoft Security Update Guide: CVE-2026-111306
- NVD API record for CVE-2026-111306
- MITRE CWE-122: Heap based Buffer Overflow
- Microsoft Office Security Releases
- Release notes for Microsoft Office security updates
- Office for Mac release notes
- How to update Microsoft 365 or Office for Windows
- Deploy updates for Office for Mac
- Zero Day Initiative: The November 2026 Security Update Review
- BleepingComputer: Microsoft November 2026 Patch Tuesday coverage
- Cyber Safety Review Board: Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft Secure Future Initiative: July 2026 progress report
- European Commission press release on Microsoft Teams commitments
- Microsoft 2026 Annual Report
