Overview of CVE-2026-111308: Numeric Truncation Leading to Heap Overflow RCE in Microsoft Word

Introduction

Microsoft's November 10, 2026 Patch Tuesday release fixed a remote code execution flaw in Word that is triggered when a user opens a specially crafted document. Because Word sits at the center of document workflows across Windows and Mac fleets, a memory corruption bug in its file-handling path is worth understanding precisely, including the constraints that limit it.

CVE-2026-111308 carries a CNA-assigned CVSS 3.1 base score of 8.8 (High), while Microsoft's own maximum severity rating is Important. The two ratings come from different systems and do not conflict. The source CVE data lists the vendor as Unknown, but the affected vendor is Microsoft, which is also the CNA for this record.

Technical information

Root cause

Microsoft and NVD describe the issue as a numeric truncation error in Microsoft Office Word that allows an unauthorized attacker to execute code over a network. Two weaknesses are assigned:

• CWE 197, Numeric Truncation Error: MITRE defines this as data loss when a value is converted to a smaller primitive type. Losing the high-order bits can produce an unexpected value that then affects an array index, loop control, or other program state.
• CWE 122, Heap-based Buffer Overflow: writing beyond the end of a buffer allocated on the heap.

This pairing describes a common memory corruption pattern in document parsers:

1. A size or count is read from the file, or calculated, as a wide integer (for example, 32-bit or 64-bit).
2. The value is stored in, or cast to, a narrower type (for example, 16-bit). The high bits are dropped, so a very large value becomes a small one.
3. The truncated small value sets the size of a heap allocation, while the original, untruncated value (or data read from the file) controls how much gets copied into it.
4. The copy runs past the end of the undersized buffer and corrupts adjacent heap memory. A carefully built document can turn that corruption into code execution.

Microsoft has not published the affected function, the exact numeric conversion, the allocation calculation, or the memory corruption sequence. The chain above is the general pattern implied by the CWE pairing. A precise truncation-to-heap-corruption chain for this CVE is not publicly confirmed. Word is closed source, so there is no public commit or diff to inspect, and we are not reproducing any code here.

Attack flow

Microsoft's exploitation explanation is short:

"This attack requires a user to open a specially crafted file from the attacker to initiate remote code execution."

Based on the advisory, the documented scenario is:

1. The attacker builds a crafted file designed to trigger the truncation and resulting heap overflow in Word.
2. The attacker supplies that file to a target user. The advisory does not name a delivery channel, file extension, or document format.
3. The user opens the file in Word.
4. Parsing the malformed content corrupts heap memory, and the attacker achieves code execution.

Microsoft explicitly states that the Preview Pane is not an attack vector. The network attack vector in the CVSS score does not remove the user interaction requirement, and nothing in the advisory supports the idea that receiving, listing, or previewing a file is enough to trigger the bug.

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector: Network: Microsoft classifies the bug as remotely exploitable.
• Attack Complexity: Low: the scoring definition requires no specialized access conditions.
• Privileges Required: None: the attacker needs no prior authorization on the target system.
• User Interaction: Required: a user must open the crafted file.
• Scope: Unchanged, with High impact to confidentiality, integrity, and availability.

Microsoft also reports a temporal score of 7.7, with E:U (exploit code maturity Unproven), RL:O (Official Fix), and RC:C (report confidence Confirmed). NVD displays Microsoft's CNA score and notes its own assessment is still awaiting enrichment.

Exploitation status

At original publication, Microsoft's advisory reported the issue as not publicly disclosed and not exploited, with an exploitability assessment of Exploitation Less Likely. The finding was credited to an anonymous researcher. The CISA Known Exploited Vulnerabilities feed we reviewed, dated November 10, 2026, did not include CVE-2026-111308. Absence from the catalog does not prove that no unreported activity exists. No threat actor, campaign, malware family, exploit code, or malicious document hashes are attributed to this CVE in the reviewed sources.

Patch information

Microsoft shipped the official fix on November 10, 2026 (Patch Tuesday), and published the MSRC advisory the same day as revision 1.0. The fix comes as updated Word and Office binaries. There is no separate configuration change to make, and MSRC lists no vulnerability-specific workaround or interim mitigation.

Microsoft has not published code-level details of the correction. Bugs in this class are normally fixed by keeping size calculations at the same integer width throughout, validating that a value fits before narrowing it, or checking the copy length against the real allocation size. The Word update most likely does one of these, though that is an inference and Microsoft has not confirmed it.

Fixed builds by product

Per the MSRC Security Update Guide (matching NVD's CNA data), a product is vulnerable below these builds and fixed at or above them:

• Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140 (Version 2408)
• Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048 (Version 2108)
• Office 365 for Mac, Office LTSC for Mac 2021, Office LTSC for Mac 2024: 16.115.26110837
• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): varies by channel, and MSRC links to the Office security releases page

Microsoft 365 Apps builds

Microsoft's release notes for Office security updates list CVE-2026-111308 under Word in the November 10, 2026 release. The Click to Run builds for that release are:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office 2024 and Office 2021 Retail: Version 2610 (Build 20527.20196)

On macOS, the Office for Mac release notes list CVE-2026-111308 among the Word security fixes in Version 16.115 (Build 26110837), dated November 10, 2026.

Verifying the fix

Compare the Word build number (File, then Account, then About Word on Windows; Word, then About Word on Mac) with the builds above. Click to Run installs (Microsoft 365 Apps, Retail, LTSC) and Office for Mac receive these fixes through their normal update channels. There are no separate per-CVE KB packages for these products, and the reviewed advisory does not state a restart requirement or supersedence information.

Affected systems and versions

The affected ranges published in Microsoft's CVE data are:

• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): from 16.0.1 up to the applicable channel security release listed above
• Microsoft Office 365 for Mac: from 1.0.0, before 16.115.26110837
• Microsoft Office LTSC 2021 (32 bit and 64 bit): from 16.0.1, before 16.0.14334.21048
• Microsoft Office LTSC 2024 (32 bit and 64 bit): from 16.0.0, before 16.0.17932.21140
• Microsoft Office LTSC for Mac 2021: from 16.0.1, before 16.115.26110837
• Microsoft Office LTSC for Mac 2024: from 16.0.0, before 16.115.26110837

The three Mac products share one fixed build but remain separately listed affected products. The MSRC advisory does not list Office 2019 or Office 2016 for this CVE, even though the same release notes page shows a November build for Office 2019 Volume Licensed. The only documented vulnerable configuration is a user opening a crafted file in an unpatched build. The Preview Pane is excluded.

Vendor security history

Microsoft's position makes Office security operationally significant. A May 14, 2026 UK Competition and Markets Authority investigation notice cited an 80% to 90% share of supply in global productivity suites in 2022 and several preceding years. That figure is historical evidence from an initial strategic market status inquiry and is not a final finding.

On the governance side, the Cyber Safety Review Board's review of the summer 2023 Exchange Online intrusion, which Microsoft attributed to the actor it tracks as Storm 0558, concluded the intrusion was preventable and that Microsoft's security culture was inadequate and required an overhaul. Microsoft's April 21, 2025 Secure Future Initiative progress report describes security work equivalent to 34,000 engineers working full time for 11 months, including hardware security modules and automatic rotation for signing keys, and calls the effort a multiyear journey.

None of this history is connected to CVE-2026-111308. The Exchange Online case is not evidence that any actor exploited this Word bug, and the reform program does not by itself establish anything about this flaw's exploitability. For this CVE, the relevant evidence is the advisory and its product-specific fixes.

References

• NVD entry for CVE-2026-111308
• CVE Record for CVE-2026-111308
• Microsoft Security Update Guide: CVE-2026-111308
• MSRC advisory portal: Microsoft Office Word Remote Code Execution Vulnerability
• Release notes for Microsoft Office security updates
• Release notes for Office for Mac
• Update history for Microsoft 365 Apps (listed by date)
• MITRE CWE 197: Numeric Truncation Error
• MITRE CWE 122: Heap-based Buffer Overflow
• CISA Known Exploited Vulnerabilities Catalog
• CISA Known Exploited Vulnerabilities JSON feed
• Zero Day Initiative: The November 2026 Security Update Review
• BleepingComputer: Microsoft November 2026 Patch Tuesday coverage
• Cybersecurity Help vulnerability database entry
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft Secure Future Initiative: April 2025 progress report
• CMA launches strategic market status investigation into Microsoft's business software ecosystem
• CMA Investigation Notice