Brief Summary: Microsoft Word CVE-2026-112715 Heap Buffer Overflow Leading to Remote Code Execution

Introduction

A heap buffer overflow in Microsoft Word, addressed in Microsoft's November 10, 2026 security release, gives an attacker a path to code execution on an affected desktop once a user opens a specially crafted file. Word ships across Windows and Mac fleets under several distinct servicing models, so the practical work for defenders is less about the bug class and more about matching every installation to the correct fixed build.

This summary covers what Microsoft has and has not disclosed about CVE-2026-112715, how to read the CVSS vector, what is known about exploitation, and which product versions are in scope.

Technical information

Root cause

Microsoft describes the issue as a heap buffer overflow in Microsoft Office Word that allows an unauthorized attacker to execute code over a network. The CVE record classifies the weakness as CWE-122: Heap-based Buffer Overflow.

MITRE defines a heap overflow as a buffer overflow in which the overwritten buffer is allocated in heap memory. The general consequences MITRE lists for this weakness class include crashes, memory modification, protection bypass, and arbitrary code execution. Those categories describe the class as a whole. They do not tell us the exact corruption sequence or exploitation primitives in this particular Word bug.

What the advisory does not disclose

The public MSRC advisory is deliberately thin on internals. It does not identify:

• the affected parser or code path
• the allocation or length calculation error
• the object or structure that gets overwritten
• the file format that triggers the overflow
• any memory protection bypass used to reach code execution

The advisory also does not establish a sandbox escape, automatic administrator privileges, or a requirement to enable macros. We have not found any vulnerable code or exploit sample in public sources, so we are not reproducing or speculating about one here.

Reading the CVSS vector

Microsoft, acting as CNA, published the following CVSS 3.1 base vector, which NVD reproduces:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector: Network. The attack is classified as remotely deliverable.
• Attack Complexity: Low.
• Privileges Required: None. The attacker needs no prior access.
• User Interaction: Required. The victim must take an action.
• Scope: Unchanged. The vector does not claim a changed security scope.
• Confidentiality, Integrity, Availability: High.

This yields a base score of 8.8 (HIGH). Microsoft's own maximum severity rating for the CVE is Important. The two come from different rating systems and do not contradict each other. NVD notes that its own independent assessment has not yet been provided.

For exposure assessment, a network attack vector with no required privileges does not remove the need for victim action. The attack depends on a user opening a document, so it is not an interaction-free network compromise.

Attack flow

Based on Microsoft's FAQ, the documented scenario is:

1. The attacker prepares a specially crafted file that triggers the heap overflow in Word. The file format is not disclosed.
2. The attacker supplies the file to the target. The advisory does not specify a delivery route and names no channel such as email, websites, or shared repositories.
3. The user opens the file in an affected Word build. Microsoft explicitly states that the Preview Pane is not an attack vector, so displaying a preview is not the documented trigger.
4. On successful exploitation, the attacker achieves code execution, with high potential impact to confidentiality, integrity, and availability under an unchanged scope.

Exploitation status

Microsoft's advisory, released November 10, 2026, records:

• Exploited: No
• Publicly disclosed: No
• Exploitability assessment: Exploitation Less Likely
• Exploit code maturity: Unproven (from the temporal scoring explanation)

No named threat actor, campaign, malware family, or victim set has been tied to this CVE in the sources we reviewed. Microsoft credits Anonymous in its acknowledgments, which is a disclosure credit rather than attacker attribution. We could not conclusively establish CISA KEV status from the retrieved catalog content, and no KEV listing for this CVE was confirmed.

The 8.8 score describes potential technical severity, while the Exploited field describes reported activity. A lack of reported exploitation is not proof of safety, and Exploitation Less Likely is not the same as unexploitable.

Affected systems and versions

The CVE record lists the following affected ranges. In each case the upper boundary is the first unaffected version.

• Microsoft Office LTSC 2021 (32-bit and x64): from 16.0.1 up to, but not including, 16.0.14334.21048
• Microsoft Office LTSC 2024 (32-bit and x64): from 16.0.0 up to, but not including, 16.0.17932.21140
• Microsoft Office 365 for Mac: from 1.0.0 up to, but not including, 16.115.26110837
• Microsoft Office LTSC for Mac 2021: from 16.0.1 up to, but not including, 16.115.26110837
• Microsoft Office LTSC for Mac 2024: from 16.0.0 up to, but not including, 16.115.26110837
• Microsoft 365 Apps for Enterprise (32-bit and x64): from 16.0.1, with the upper boundary defined by Microsoft's channel-specific Office security releases

For Microsoft 365 Apps for Enterprise, Microsoft's November 10, 2026 Office security release notes list these builds:

• Current Channel: Version 2610, build 20527.20196
• Monthly Enterprise Channel: Version 2610, build 20527.20194; Version 2609, build 20430.20264; Version 2608, build 20326.20320
• Semi Annual Enterprise Channel (receiving Monthly Enterprise Channel builds): Version 2610, build 20527.20192; Version 2609, build 20430.20262; Version 2608, build 20326.20318

Each of these builds belongs to its own channel and version, and they are not interchangeable targets. No single build number applies across all Office products.

The Office security release notes list this CVE under Access, while the MSRC advisory and the CVE description identify Word. We follow the MSRC advisory and CVE record for the vulnerability's identity, but teams reconciling inventories against the release notes should be aware of the discrepancy. Individual KB identifiers were not available in the retrieved update table, and the Mac release notes we reviewed did not yet expose the November entry, although the CVE record supplies the Mac version boundary.

Microsoft's advisory identifies no workaround or alternative configuration fix. Disabling macros, disabling the Preview Pane, and registry changes are not documented remedies for this CVE.

Vendor security history

Microsoft is the CNA and confirmed vendor. The Cyber Safety Review Board describes Microsoft's products as supporting essential services across national security, the economy, and public health and safety.

The Board's review of the summer 2023 Exchange Online intrusion documented access to official email accounts of senior United States government officials by an actor the Board associates with the government of the People's Republic of China. The Board attributed the intrusion's success to a cascade of Microsoft security failures, and criticized Microsoft's failure to independently detect the compromise of its cryptographic assets and its delayed correction of inaccurate public statements.

In a June 13, 2024 response, Microsoft accepted responsibility for the issues the Board raised and described its Secure Future Initiative, organized around Secure by Design, Secure by Default, and Secure Operations, along with an Office of the CISO, senior Deputy CISOs, and security-linked leadership accountability. These are vendor-reported commitments, not an independent finding that the earlier weaknesses are resolved. Nothing in this history connects the Exchange Online intrusion to CVE-2026-112715. We include it as context for vendor risk, and it says nothing about this bug.

References

• NVD: CVE-2026-112715
• CVE Record: CVE-2026-112715
• Microsoft Security Update Guide: CVE-2026-112715, Microsoft Office Word Remote Code Execution Vulnerability
• MITRE CWE-122: Heap-based Buffer Overflow
• Microsoft Learn: Release notes for Microsoft Office security updates
• Microsoft Office security releases (short link)
• Microsoft Learn: Release notes for Office for Mac
• Microsoft Support: How to update Microsoft 365 or Office for Windows
• Microsoft Support: Update Office for Mac automatically
• CISA Known Exploited Vulnerabilities catalog (JSON feed)
• Cyber Safety Review Board: Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft On the Issues: Microsoft's work to strengthen cybersecurity protection
• Microsoft 365: Microsoft Word product page
• BleepingComputer: Microsoft November 2026 Patch Tuesday coverage