Brief Summary: Microsoft Word CVE-2026-111307 Heap-Based Buffer Overflow Leading to Remote Code Execution

Introduction

Microsoft's November 10, 2026 Patch Tuesday release fixed a heap-based buffer overflow in Word that can lead to code execution once a user opens a specially crafted file. Opening documents is routine work for nearly every Office user, so a parsing flaw rated CVSS 8.8 deserves prompt attention, even though Microsoft currently reports no public disclosure and no exploitation.

Technical information

Root cause

CVE-2026-111307 is classified as CWE-122, a heap-based buffer overflow, meaning a program writes beyond the bounds of a buffer allocated on the heap. In this case, Word writes data parsed from a document into a heap buffer that is too small to hold it. Fixes for this class of bug usually add checks that the data fits before it is copied in.

Microsoft has not said which parser, record type, or document structure is involved. Word is closed source, there is no public commit or diff, and we found no public binary-diff write-ups, so the exact vulnerable code path and the precise code change remain unknown. For that reason, this post contains no code snippets.

CISA lists the general consequences of heap overflows as data corruption, sensitive data exposure, crashes, unauthorized code execution, initial network access, and lateral movement. These describe the weakness class, not observed impacts of this specific CVE.

Scoring

Microsoft rates the issue Important and supplies the following CVSS 3.1 vector, which NVD records without its own assessment:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• AV:N: network attack vector
• AC:L: low attack complexity
• PR:N: no privileges required
• UI:R: user interaction required
• S:U: unchanged scope
• C:H / I:H / A:H: high confidentiality, integrity, and availability impact

The base score is 8.8. Microsoft's temporal score is 7.7, which reflects exploit code maturity of Unproven and a Remediation Level of Official Fix ("A complete vendor solution is available").

Attack flow

Based on Microsoft's advisory, exploitation proceeds as follows:

1. The attacker prepares a specially crafted file containing data that triggers the overflow when Word parses it.
2. The attacker delivers the file to the target over a network. No privileges or prior access on the target are needed.
3. The victim opens the file in Word. This step is mandatory. Microsoft states that the Preview Pane is not an attack vector, so previewing the file alone does not trigger the bug.
4. Word parses the document and writes the attacker-controlled data into an undersized heap buffer, corrupting memory beyond its bounds.
5. Successful exploitation can result in remote code execution, with high impact to confidentiality, integrity, and availability.

Exploitation status

At publication of the advisory, Microsoft lists the vulnerability as not publicly disclosed and not exploited, with an exploitability assessment of Exploitation Less Likely and exploit code maturity of Unproven. No threat actor, malware family, campaign, or victim is named in any source we reviewed. These are point-in-time assessments, so it is worth rechecking the MSRC record during response work.

Patch information

Microsoft fixed CVE-2026-111307 in its November 10, 2026 Patch Tuesday release. The advisory is revision 1.0, published the same day. The fix ships as updated Office binaries, and the way to confirm you have it is to check the installed build number.

Fixed builds by product

From MSRC and the CNA data on NVD:

• Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140, delivered as a Security Update, Version 2408
• Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048, delivered as a Security Update, Version 2108
• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): depends on update channel, delivered as a Click to Run channel update
• Office 365 for Mac, Office LTSC for Mac 2021 and 2024: 16.115.26110837, delivered as Office for Mac 16.115

For Microsoft 365 Apps, Microsoft does not give one number. Because the build depends on the channel, it points to the Office security release notes instead.

Microsoft 365 Apps channel builds

Microsoft's Office security release notes list CVE-2026-111307 in the November 10, 2026 entry with these builds:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: 2610 (20527.20194), 2609 (20430.20264), 2608 (20326.20320)
• Semi Annual Enterprise Channel: 2610 (20527.20192), 2609 (20430.20262), 2608 (20326.20318)
• Office 2024/2021 Retail: Version 2610 (Build 20527.20196)

The release notes also show a build for Office 2019 Volume Licensed (10417.20236). However, MSRC's product table for this CVE does not list Office 2019, so that build does not indicate Office 2019 is in scope for this bug.

Cumulative delivery

The same updates fix dozens of other Word bugs released the same day. Tenable's Nessus plugin 378503 for Office on macOS groups CVE-2026-111307 with about 40 other "Heap based buffer overflow in Microsoft Office Word" CVEs, and its listed solution is to update to Office for Mac 16.115 or later. ZDI's November review counts 65 Word CVEs this month. Because the fixes come as one cumulative build, you cannot install the patch for this CVE by itself. Moving to the fixed build applies all of them.

Verifying the patch

• Windows: open File, Account, About Word, or check the Click to Run version in the registry. The build should be at or above the value for your product or channel.
• Mac: the build should be 16.115.26110837 or later.

Scanners such as the Nessus plugin only read the version number the application reports and do not test for the bug, so comparing build numbers is the real check. Microsoft has not documented a workaround for this CVE.

Affected systems and versions

NVD lists the following affected ranges, where every version below the listed build is vulnerable:

• Microsoft 365 Apps for Enterprise: from 16.0.1, before the Office Security Releases threshold for the relevant channel
• Microsoft Office 365 for Mac: from 1.0.0, before 16.115.26110837
• Microsoft Office LTSC 2021: from 16.0.1, before 16.0.14334.21048
• Microsoft Office LTSC 2024: from 16.0.0, before 16.0.17932.21140
• Microsoft Office LTSC for Mac 2021: from 16.0.1, before 16.115.26110837
• Microsoft Office LTSC for Mac 2024: from 16.0.0, before 16.115.26110837

The vulnerable configuration requires a user to open a crafted file in Word. The Preview Pane is not an attack path.

Vendor security history

One notable case in Microsoft's track record is the US Cyber Safety Review Board's review of the 2023 Microsoft Exchange Online intrusion. The Board reported that Storm-0558, which it assessed as affiliated with the People's Republic of China and pursuing espionage objectives, compromised mailboxes at 22 organizations and more than 500 individuals. It found Microsoft's security culture inadequate and criticized the failure to detect a key compromise without a customer report, as well as the delay in correcting inaccurate public statements. That incident involved authentication keys and cloud email rather than Word, so it is context for vendor governance, not evidence about this flaw.

References

• Microsoft Security Update Guide: CVE-2026-111307
• NVD: CVE-2026-111307
• CVE.org record: CVE-2026-111307
• NVD API record for CVE-2026-111307
• Microsoft 365 Apps security updates release notes
• Tenable Nessus plugin 378503
• Vulners: Security Updates for Microsoft Office Products (November 2026), macOS
• Zero Day Initiative: The November 2026 Security Update Review
• MITRE CWE-122: Heap based Buffer Overflow
• CISA Secure by Design Alert: Eliminating Buffer Overflow Vulnerabilities
• Cyber Safety Review Board: Review of the Summer 2023 Microsoft Exchange Online Intrusion