Brief Summary: Microsoft Word CVE-2026-112716 Heap Buffer Overflow Leading to Remote Code Execution

Introduction

A heap buffer overflow in Microsoft Office Word, fixed in the November 10, 2026 Patch Tuesday release, can give an attacker code execution on a workstation once a user opens a specially crafted document. Because the affected product list spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and Office for Mac, remediation touches subscription, volume-licensed, and macOS installations alike, each with its own fixed build.

The CVE data we started from lists the vendor as "Unknown". The MSRC advisory makes clear the vendor is Microsoft, which is also the assigning CNA. Below we summarize what Microsoft has actually published, where the public record stops, and which build numbers close the bug.

Technical information

Root cause

Microsoft describes CVE-2026-112716 as a heap-based buffer overflow in Word that allows an unauthorized attacker to execute code over a network, and maps it to CWE-122: Heap-based Buffer Overflow. MITRE defines this weakness as an overflow of a buffer allocated in heap memory. In general, such corruption can crash the process and, in some circumstances, overwrite function pointers or lead to arbitrary code execution.

Those are properties of the weakness class. They do not reconstruct this specific defect. Word is closed source, and Microsoft has not disclosed the vulnerable parsing routine, the file structure that triggers the overflow, or the exploitation primitive. No vulnerable code or binary diff analysis is available in the sources we reviewed, so we do not present any.

Scoring breakdown

Microsoft publishes the following CVSS 3.1 vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

The base score is 8.8 and the temporal score is 7.7. Two points are worth keeping straight:

• The CVSS rating (High) and Microsoft's product severity classification (Important) come from separate rating systems, so they do not contradict each other.
• NVD displays Microsoft's 8.8 HIGH score, but the record is marked Awaiting Enrichment, and NIST has not supplied its own score. The NVD entry corroborates the CNA assessment rather than independently scoring it.

Network vector, local action

The phrase "execute code over a network" is broader than the documented trigger. Microsoft's FAQ states that exploitation requires a user to open a specially crafted file from the attacker. The record does not describe an exposed network service that can be compromised without user involvement.

Microsoft also states explicitly that the Preview Pane is not an attack vector. Previewing a file is therefore not a documented trigger for this CVE. The advisory does not disclose a specific file extension, a macro requirement, a delivery campaign, a payload, or an exploit chain.

Attack flow

Based only on what Microsoft has published, the exploitation sequence looks like this:

1. The attacker prepares a Word file crafted to cause a heap buffer overflow when Word processes it. The specific malformed structure has not been disclosed.
2. The attacker gets the file to the target. The vector is rated network, but the advisory does not name a delivery channel.
3. The user opens the file in a vulnerable Word build. Simply previewing it in the Preview Pane is not a documented trigger.
4. While processing the file, Word overflows a heap buffer.
5. Successful exploitation can lead to code execution with High confidentiality, integrity, and availability impact within the affected application context (scope unchanged).

Exploitation status at publication

The CVE record also carries a CISA assessment using Stakeholder Specific Vulnerability Categorization (SSVC), which rates Exploitation as none, Automatable as no, and Technical Impact as total. Microsoft credits the report to Anonymous, which identifies neither an attacker nor a campaign.

The reviewed records name no threat actor, malware family, campaign, victim, or targeting pattern, and supply no hashes, infrastructure, exploit samples, or CVE-specific signatures. High potential impact and the absence of reported exploitation answer different questions, and neither cancels the other. These statuses are also explicitly tied to the time of original publication.

Patch information

Microsoft fixed CVE-2026-112716 in its November 10, 2026 Patch Tuesday release (MSRC release 2026-Nov). Since Word is closed source, there is no public commit or diff, so the patch is identified by the build that closes the bug rather than by the lines that changed. Microsoft's affected product data marks every listed SKU as productStatus: "fixed" with customerActionRequired: true, meaning the fix is not in place until the updated build is installed.

Fixed builds by product

Reading the Microsoft 365 Apps entry

Microsoft 365 Apps is serviced through several channels at once, so MSRC cannot name one fixed build. Its fixedBuildNumber field links to the Office security release notes instead. Those notes list CVE-2026-112716 under the Word section of the November 10 update. Builds shipped that day include:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office 2024/2021 Retail: Version 2610 (Build 20527.20196)

These are cumulative thresholds: any build at or above the fixed number for your channel contains the fix, and anything below it is still vulnerable. For LTSC volume-licensed installs, check the build suffix, which is 17932.21140 for 2024 and 14334.21048 for 2021. On the Mac, the patched release is 16.115.26110837.

One documentation note: our source briefing flagged an Office release notes reading that placed this CVE under an Access heading, while the patch data we were given places it under Word. The LTSC fixed builds agree in both, and the dedicated MSRC advisory, which names Microsoft Office Word, remains the authoritative description.

What the fix probably does (inference only)

Microsoft has not described the code change, and none of the sources include binary diff analysis. Fixes for CWE-122 in document parsers usually add or correct a bounds check, either by validating a length or count field read from the file against the size of the destination heap buffer, or by computing the allocation size safely so it cannot overflow. This is background on the bug class and does not describe this patch.

Release context

This is one of many Word CVEs in a large November Office release. ZDI counts 65 Word CVEs that month. The temporal vector's RL:O (Remediation Level: Official Fix) indicates the vendor has shipped a full fix.

Applying the update

On Windows, Microsoft documents these steps:

1. Open an Office app such as Word and create a new document.
2. Select File > Account.
3. Under Product Information, select Update Options > Update Now. Select Enable Updates first if needed.

If only About is shown, the install may be volume licensed or managed via Group Policy. Microsoft suggests trying Microsoft Update or contacting your help desk.

On Mac:

1. In an Office app, use Help > Check for Updates.
2. In Microsoft AutoUpdate, select Update or Update All.
3. Restart the app afterward.

Work or school users should follow organizational guidance.

Microsoft describes Protected View as a mode that disables most editing functions and reduces risk from files in potentially unsafe locations. Nothing in the advisory establishes that Protected View prevents exploitation of this CVE, so it should not be treated as a substitute for the update.

Affected systems and versions

The following ranges come from NVD and the Microsoft CNA record:

Do not apply LTSC or Mac build numbers to Microsoft 365 Apps installations. Use the channel-specific builds listed above. Installed desktop Word is in scope regardless of cloud connectivity, since Microsoft notes installed apps run without an internet connection.

Vendor security history

Microsoft holds a strong position in productivity software. CRN reports that UBS called Microsoft's position in employee productivity software dominant, a characterization Google and its partners dispute.

The Cyber Safety Review Board's review of the summer 2023 Exchange Online intrusion offers an independent view of Microsoft's track record. It describes a threat actor using a stolen Microsoft signing key, identifies shortcomings in detection, customer visibility, and Microsoft's public explanation, and concludes that Microsoft's decisions reflected a culture that deprioritized enterprise security investments and rigorous risk management. The Board recommended greater transparency, prompt correction of significant inaccuracies, and comprehensive vulnerability disclosure. That case concerns Exchange Online and cloud identity. It is not evidence of exploitation of CVE-2026-112716 and says nothing about the cause of this Word overflow.

Microsoft's July 2026 Secure Future Initiative report describes embedding security into culture, governance, and engineering, with Zero Trust principles integrated into platforms, pipelines, and governance systems. These are Microsoft's own reported improvements. For this CVE, the concrete vendor response is the advisory, exploitation assessment, affected product data, and fixed builds.

References

• NVD: CVE-2026-112716
• CVE Record: CVE-2026-112716
• Microsoft Security Update Guide: CVE-2026-112716
• MSRC affected product API for CVE-2026-112716
• Release notes for Microsoft Office security updates
• ZDI: The November 2026 Security Update Review
• CVE Services JSON record (cveawg.mitre.org)
• MITRE CWE-122: Heap-based Buffer Overflow
• How to update Microsoft 365 or Office for Windows
• Update Microsoft 365 or Office on macOS or iOS
• What is Protected View?
• What is Microsoft 365
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft SFI Progress Report, July 2026
• Microsoft On the Issues: Microsoft's work to strengthen cybersecurity protection
• CRN: Microsoft vs. Google productivity apps, UBS report