Introduction
A malformed Word document remains one of the most dependable ways to reach a corporate endpoint, and Microsoft's November 2026 Patch Tuesday closed another path of exactly that kind. CVE-2026-111310, a heap-based buffer overflow in Microsoft Office Word with a CVSS 3.1 base score of 8.8, can lead to code execution once a user opens a specially crafted file.
Microsoft rates the issue Important. At original publication, the Security Update Guide stated it had not been publicly disclosed or exploited, assessed exploitation as less likely, and rated exploit code maturity as Unproven. An Official Fix shipped on November 10, 2026.
Technical information
Root cause classification
Microsoft describes the flaw as a heap-based buffer overflow in Word that allows an unauthorized attacker to execute code. The advisory tags it with two weaknesses:
- CWE-122, Heap-based Buffer Overflow
- CWE-190, Integer Overflow or Wraparound
Word is closed source, and Microsoft has published no diff, commit, patch notes, memory layout details, or root-cause write-up. The advisory does not explain how the integer overflow contributes to the heap overflow, nor which parser or record type is involved.
The CWE pairing does point at a familiar bug class. In our reading, it usually describes this chain: a size or count is computed from attacker-controlled document data, the arithmetic wraps around, the program allocates a heap buffer that is too small, and subsequent writes run past its end. Fixes for this class typically add checked or saturating arithmetic, or validate the value before allocation, so the parse fails safely rather than corrupting memory. This is inference from the CWE tags. Microsoft has not confirmed the mechanism.
CVSS breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Base: 8.8 Temporal: 7.7
- AV:N: the malicious file can be delivered over a network.
- AC:L / PR:N: low complexity, no privileges required.
- UI:R: a user must open the crafted file. This is the main constraint on exploitation.
- S:U: scope unchanged.
- C:H / I:H / A:H: high impact to confidentiality, integrity, and availability.
- E:U / RL:O / RC:C: exploit maturity Unproven, Official Fix available, report confidence Confirmed. These temporal metrics bring the score from 8.8 down to 7.7.
Attack flow
Based on Microsoft's advisory, exploitation looks like this:
- The attacker builds a specially crafted Word file containing data that triggers the overflow.
- The attacker sends the file to the target user.
- The victim opens the file in Word. Microsoft explicitly states the Preview Pane is not an attack vector, so merely previewing the file is not described as sufficient.
- Word's processing of the malformed content overflows a heap buffer, which Microsoft rates as capable of leading to code execution.
The advisory provides no proof of concept, no exploit chain beyond opening the crafted file, and nothing that would help reproduce exploitation.
Exploitation status
At publication Microsoft reported no public disclosure and no exploitation, rated exploitation as less likely, and marked exploit code maturity Unproven. The record names no threat actor, campaign, or victim sector. CISA's November 10, 2026 Known Exploited Vulnerabilities additions do not include CVE-2026-111310. That does not rule out a later catalog addition, but the strongest CVE-specific evidence remains Microsoft's statement that it was not exploited at publication.
Patch information
Microsoft fixed CVE-2026-111310 in its November 10, 2026 Patch Tuesday release. The advisory (revision 1.0, information published November 10, 2026) sets the CVSS Remediation Level to Official Fix, meaning a complete vendor fix is available. The fix ships as an ordinary product build update, not a standalone hotfix, and the advisory lists no workaround or registry mitigation.
Delivery:
- Windows (Office LTSC 2021, Office LTSC 2024, Microsoft 365 Apps): delivered through the normal Office Click to Run servicing channel. The MSRC entries link to the Microsoft 365 Apps security update release notes rather than to a separate MSI or KB package.
- macOS: delivered as the November Office for Mac update, with the Office for Mac release notes linked as both the KB article and the download.
The fix lands in the same cumulative build as many other Office fixes from that Patch Tuesday. HTMD's November 2026 roundup lists CVE-2026-111310 alongside dozens of other Microsoft Office Word Remote Code Execution CVEs, for example CVE-2026-111308, CVE-2026-111307, and CVE-2026-112714. Installing the fixed build should address that whole group of Word parsing bugs at once.
Verifying the fix: open Word and go to File > Account > About Word, or query your endpoint inventory, then compare the reported version and build against the list below. Microsoft's affected-version data on NVD uses strict "less than" ranges, so any device at or above the listed build has the fix.
Disabling the Preview Pane is not a CVE-specific mitigation for this issue, because Microsoft states the Preview Pane is not an attack vector.
Affected systems and versions
Per the MSRC update table and Microsoft-supplied affected ranges on NVD, any build below the following is vulnerable:
- Microsoft Office LTSC 2021 (32 bit and 64 bit): fixed in
16.0.14334.21048. NVD range:16.0.1 < 16.0.14334.21048. - Microsoft Office LTSC 2024 (32 bit and 64 bit): fixed in
16.0.17932.21140. - Microsoft Office 365 for Mac: fixed in
16.115.26110837. - Microsoft Office LTSC for Mac 2021: fixed in
16.115.26110837. - Microsoft Office LTSC for Mac 2024: fixed in
16.115.26110837. - Microsoft 365 Apps for Enterprise (32 bit and 64 bit): fixed build depends on the update channel (Current, Monthly Enterprise, Semi Annual, and others). Each Click to Run channel receives its own November build. See Microsoft 365 Apps security updates.
The Mac SKUs all share a single fixed build, 16.115.26110837, documented in the Office for Mac release notes.
Vendor security history
CVE-2026-111310 is one of many Word remote code execution fixes in the November 2026 release, including CVE-2026-111308, CVE-2026-111307, and CVE-2026-112714, which suggests Word's document parsing continues to be a productive area for memory-safety findings.
For broader context on Microsoft's security track record, the Cyber Safety Review Board investigated the 2023 Exchange Online intrusion attributed to Storm-0558, an actor assessed as affiliated with the People's Republic of China. The CSRB found that intrusion preventable and concluded that Microsoft's security culture was inadequate and required an overhaul. Microsoft later said it accepted responsibility for the issues cited and committed to address applicable recommendations, describing its Secure Future Initiative in testimony.
That cloud identity and email incident has no established technical connection to CVE-2026-111310, and the Storm-0558 attribution must not be applied to this CVE.
References
- MSRC Security Update Guide: CVE-2026-111310
- NVD: CVE-2026-111310
- CVE.org record: CVE-2026-111310
- HTMD: Microsoft fixes 1235 security vulnerabilities (November 2026 roundup)
- Microsoft 365 Apps security updates release notes
- cvefeed.io: CVE-2026-111310
- MSRC Security Update Guide: CVE-2026-111308 (related Word RCE)
- CISA: Adds Six Known Exploited Vulnerabilities to Catalog (November 10, 2026)
- Microsoft 2026 Annual Report
- Microsoft 2026 Digital Defense Report
- CSRB: Review of the Summer 2023 Microsoft Exchange Online Intrusion
- DHS: Cyber Safety Review Board Releases Report on Microsoft Online Exchange Incident
- Microsoft On the Issues: Microsoft's work to strengthen cybersecurity protection
