Quick Look: CVE-2026-112714, a Microsoft Word Heap Buffer Overflow Enabling Remote Code Execution

Introduction

A heap buffer overflow in Microsoft Word, fixed in the November 10, 2026 Patch Tuesday release, allows an attacker to execute code once a user opens a specially crafted file. The affected product list covers Microsoft 365 Apps for Enterprise and the current Office LTSC editions on both Windows and Mac, so this fix is relevant to most enterprise Office fleets, even though Microsoft reports no exploitation at release.

Microsoft is the vendor and the assigning CNA for CVE-2026-112714, which resolves the Unknown vendor value in the raw CVE data. MSRC titles the issue Microsoft Office Word Remote Code Execution Vulnerability.

Technical information

Root cause

The weakness is classified as CWE-122, Heap based Buffer Overflow. MITRE defines this as a buffer overflow in which the overwritten buffer was allocated on the heap, and its general description notes that heap overflows can be used to overwrite function pointers and redirect execution toward attacker code. That describes the weakness class. It does not establish the exact corruption technique used in this Word bug.

In this class of bug, a document parser writes more data into a heap allocation than the allocation can hold, usually because it trusts a length or count field taken from the file itself. The patched Word code adds the bounds or size validation that stops the overflow before it can corrupt neighboring heap memory.

Microsoft has not said which file format, document structure, parsing function or component is affected. The reviewed CVE and advisory records also do not include a reproducer, exploit source, memory layout or detailed corruption primitive, so we are not going to speculate about specific heap grooming techniques or which memory protections might be bypassed.

Attack flow

Based on the MSRC advisory, the confirmed exploitation sequence is narrow:

1. The attacker constructs a specially crafted file that reaches the vulnerable Word code path.
2. The attacker supplies that file to a target. No prior privileges on the target system are required. Microsoft does not specify a delivery channel.
3. A user opens the file in Word. This step is mandatory. The MSRC FAQ states that the Preview Pane is not an attack vector, so the patched code path is only reached when the document is actually opened.
4. Word parses the crafted content, the heap overflow occurs, and according to Microsoft this can result in remote code execution.

CVSS breakdown

The full vector published by Microsoft is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• Attack Vector: Network. This should not be read as evidence that Word exposes an independently exploitable network service. The documented trigger is opening a file.
• Attack Complexity: Low.
• Privileges Required: None.
• User Interaction: Required. A user must open the crafted file.
• Scope: Unchanged.
• Confidentiality, Integrity, Availability: High for all three, reflecting code execution rather than a simple crash.
• Temporal metrics: Exploit Code Maturity Unproven (E:U), Remediation Level Official Fix (RL:O), Report Confidence Confirmed (RC:C).

The base score is 8.8 (High) and the temporal score is 7.7. Microsoft's own product severity rating is Important. These come from separate rating systems and are not conflicting assessments. NVD displays Microsoft's 8.8 score but has not supplied its own assessment. The NVD record is Awaiting Enrichment.

For exposure analysis, the combination that matters is no prior privileges but required user interaction. Base the analysis on the file-opening requirement rather than an assumed Preview Pane or interaction-free path.

Exploitation status

• Microsoft: Exploited: No, Publicly disclosed: No, Exploitability assessment: Exploitation Less Likely.
• CISA SSVC (contributed to the CVE record): Exploitation: none, Automatable: no, Technical Impact: total.
• CISA KEV: Not listed in catalog version 2026.11.10. That reflects a catalog snapshot and does not prove that exploitation is impossible.
• Attribution: No named threat actor, campaign, public exploit or CVE-specific indicators of compromise appear in the reviewed sources. The finder is credited only as Anonymous, which is a disclosure credit, not attacker attribution.

Contemporaneous coverage of the November 2026 Patch Tuesday discusses an actively exploited Outlook zero day, CVE-2026-124194. That is a different identifier and a different product issue, and its exploitation should not be attributed to this Word CVE.

Potential impact and observed exploitation are separate questions. A High CVSS score and an Exploitation Less Likely assessment answer different ones, and neither cancels the other.

Patch information

Microsoft fixed CVE-2026-112714 in its November 10, 2026 Patch Tuesday release. This is a closed-source binary update, so there is no public commit or diff to review. The published list of fixed builds per servicing channel is the practical definition of the fix. MSRC lists all nine affected product entries as productStatus: fixed and marks every one Customer Action Required.

Fixed builds by product

• Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140 (Version 2408)
• Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048 (Version 2108)
• Microsoft Office LTSC for Mac 2021, Office LTSC for Mac 2024, Office 365 for Mac: 16.115.26110837
• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): see the channel builds below

For Microsoft 365 Apps, MSRC links to the Office security release notes, which list CVE-2026-112714 under Word in the November 10, 2026 entry with these patched builds:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office 2024 Retail and Office 2021 Retail: Version 2610 (Build 20527.20196)

Verifying installation

Click to Run Office updates the whole suite at once rather than patching a single DLL. On Windows, check the build number under File > Account > About Word and confirm it is equal to or higher than the build listed for that machine's channel. On macOS, Word should report version 16.115 (26110837) or later.

Office remains vulnerable until it restarts after the update downloads, because the old Word binaries stay loaded in memory until then. Fleet compliance checks should account for this.

Updating on Windows

Microsoft Support documents the general update procedure for Microsoft 365 or Office on Windows:

1. Open an application such as Word and create a new document.
2. Select File > Account.
3. Under Product Information, select Update Options > Update Now.
4. If necessary, select Enable Updates first and then check again.
5. If Update Options is missing and only About appears, the installation may use volume licensing or company-managed Group Policy updates. Microsoft's guidance is to try Microsoft Update or contact the company help desk.

The absence of a manual update button is not evidence that a machine is protected.

Workarounds

The advisory lists no CVE-specific workaround or additional mitigation. The Preview Pane exclusion is a technical distinction about the trigger. It is not a substitute for applying the official fix.

Affected systems and versions

The CNA record uses lessThan boundaries, meaning the listed build is the first fixed build and is itself excluded from the affected range. Builds below these values are affected:

• Microsoft Office LTSC 2024 (32 bit and x64): versions below 16.0.17932.21140
• Microsoft Office LTSC 2021 (32 bit and x64): versions below 16.0.14334.21048
• Microsoft Office LTSC for Mac 2024: versions below 16.115.26110837
• Microsoft Office LTSC for Mac 2021: versions below 16.115.26110837
• Microsoft Office 365 for Mac: versions below 16.115.26110837
• Microsoft 365 Apps for Enterprise (32 bit and x64): the CNA record points to the Office Security Releases page rather than a single numeric build. Use the channel-specific builds listed in the Patch information section.

These boundaries are product specific. The Microsoft 365 Apps entry should not be collapsed into a single universal fixed build.

Vendor security history

Word has had prior heap memory safety issues. Microsoft's June 10, 2025 advisory for CVE-2025-32717 documents another Word heap buffer overflow leading to remote code execution. The two bugs share a weakness class but differ operationally:

• Trigger: CVE-2025-32717 included the Preview Pane as an attack vector and permitted exploitation without user interaction. CVE-2026-112714 requires opening the file and excludes the Preview Pane.
• Microsoft severity: Critical for CVE-2025-32717, Important for CVE-2026-112714.
• Exploitability assessment: Exploitation More Likely for CVE-2025-32717, Exploitation Less Likely for CVE-2026-112714.
• Reported exploitation: No for both.
• Remediation: An official fix was available for both.

The shared CWE label does not imply a shared root cause, trigger or campaign, so patch prioritization should follow each advisory's specific fields.

On the broader program side, Microsoft's July 2026 Secure Future Initiative report describes embedding security into culture, governance and engineering and applying Zero Trust principles through controls in platforms, engineering pipelines and governance systems. These are Microsoft's statements about its security program, not independent evidence about how this particular defect was introduced or found.

For market context, European Commission proceedings describe Microsoft's productivity applications as including Word, Excel, PowerPoint and Outlook, and preliminarily find Microsoft dominant in the worldwide market for SaaS productivity applications for professional use. That finding concerns the suite market, not a count of vulnerable Word installations.

References

• NVD entry for CVE-2026-112714
• Official CVE record for CVE-2026-112714 (CVE Services API)
• MSRC Security Update Guide: CVE-2026-112714
• MSRC API: CVE-2026-112714 vulnerability data
• MSRC API: affected products for CVE-2026-112714
• Microsoft Learn: Microsoft 365 Apps security updates
• Microsoft Learn: Release notes for Microsoft Office security updates
• Zero Day Initiative: The November 2026 Security Update Review
• Microsoft Support: How to update Microsoft 365 or Office for Windows
• MITRE CWE-122: Heap based Buffer Overflow
• MSRC Security Update Guide: CVE-2025-32717
• BleepingComputer: Microsoft November 2026 Patch Tuesday coverage
• CISA Known Exploited Vulnerabilities Catalog
• CISA KEV JSON feed
• Microsoft Secure Future Initiative progress report, July 2026
• EUR-Lex: European Commission proceedings concerning Microsoft
• European Commission: Statement of Objections to Microsoft regarding Teams