Introduction
A heap-based buffer overflow in Microsoft Office Word, fixed in the November 10, 2026 Patch Tuesday release, allows an attacker to execute code on a victim's machine once that user opens a specially crafted document. Because the affected list spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and Office for Mac, the update touches most managed Office fleets, and confirming remediation comes down to comparing installed build numbers against Microsoft's fixed builds.
Technical information
Root cause
Microsoft, acting as the CNA, classifies CVE-2026-112717 as CWE-122: Heap Based Buffer Overflow in Word, which allows an unauthorized attacker to execute code over a network. MITRE defines this weakness as an overflow condition in a buffer allocated on the heap. General consequences of the class include memory modification, crashes, and arbitrary code execution.
In this kind of bug, Word's document parser writes past the end of a heap allocation while handling attacker-controlled data from the file. The fix will be some form of bounds or size check in the affected parsing code, but Microsoft has not disclosed which component, routine, record type, corrupted object, or file format is involved. Office is closed source, so there is no public commit or diff to examine, and the published material does not support reconstructing a more detailed exploit chain. The advisory also does not state what privileges an attacker obtains after successful exploitation.
CVSS breakdown
Microsoft publishes the following vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Base score: 8.8, High (NVD)
- Temporal score: 7.7 (Microsoft)
- Microsoft severity classification: Important, not Critical
| Metric | Value | Meaning |
|---|---|---|
| Attack Vector | Network | Remote attack context |
| Attack Complexity | Low | No specialized access conditions in the scoring model |
| Privileges Required | None | The attacker needs no prior authorized access |
| User Interaction | Required | A user must take an action for exploitation to succeed |
| Scope | Unchanged | No security authority boundary crossing is described |
| Confidentiality, Integrity, Availability | High | Successful exploitation can seriously compromise each |
The temporal metrics are E:U (exploit code maturity Unproven), RL:O (official fix available), and RC:C (report confidence Confirmed).
AV:N does not remove the user interaction requirement, and the advisory's own attack description tells you more than the attack vector metric alone. The ratings 8.8 High, Important, and Exploitation Less Likely answer separate questions about technical severity, vendor classification, and assessed likelihood of exploitation, so they do not contradict each other.
Attack flow
Based on the advisory, the documented scenario looks like this:
- The attacker prepares a specially crafted file containing data that triggers the heap overflow in Word. The exact structure or file format has not been disclosed.
- The attacker supplies the file to a target. Microsoft does not specify a delivery channel, attachment type, or social engineering method.
- The user opens the file in an unpatched build of Word. Microsoft explicitly states that the Preview Pane is not an attack vector, so merely previewing the file is a materially different scenario from opening it.
- While parsing the file, Word writes beyond a heap buffer, corrupting adjacent memory. For this weakness class, that corruption can be leveraged into arbitrary code execution, which Microsoft's description confirms is the outcome here.
For exposure assessment, model the risk as an affected Office installation encountering an attacker-supplied file that a user actually opens, rather than as an automatic preview exploit.
Exploitation status
Microsoft's exploitability assessment, tied to original publication, states "Publicly disclosed: No," "Exploited: No," and "Exploitation Less Likely." CISA's enrichment in the CVE record, dated November 10, 2026, lists "Exploitation: none," "Automatable: no," and "Technical Impact: total."
No threat actor, malware family, campaign, or indicators of compromise are associated with this CVE. The advisory's acknowledgement reads Anonymous, which reflects coordinated disclosure and is not evidence of attacker identity. These assessments are dated, and they do not guarantee that exploitation will not occur.
Patch information
Microsoft fixed CVE-2026-112717 in its November 10, 2026 Patch Tuesday release. The fix ships as updated Word and Office binaries, and the way to confirm it is to compare your installed build number against Microsoft's fixed build.
Microsoft's Security Update Guide API marks every affected product as productStatus: "fixed", and every entry has customerActionRequired: true, so the update must actually be installed.
Fixed builds by product (MSRC data)
- Microsoft Office LTSC 2024 (32 bit and 64 bit):
16.0.17932.21140 - Microsoft Office LTSC 2021 (32 bit and 64 bit):
16.0.14334.21048 - Microsoft Office 365 for Mac:
16.115.26110837 - Office LTSC for Mac 2021 and 2024:
16.115.26110837 - Microsoft 365 Apps for Enterprise (32 bit and 64 bit): channel dependent, and MSRC points to
aka.ms/OfficeSecurityReleases
NVD's affected version ranges match these builds, so anything below them is vulnerable.
Click to Run channel builds
For Microsoft 365 Apps, the fixed build depends on the update channel. Microsoft's Release notes for Microsoft Office security updates page lists CVE-2026-112717 under Word in the November 10, 2026 entry, with these builds:
- Current Channel: Version 2610 (Build 20527.20196)
- Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
- Semi Annual Enterprise Channel (receives Monthly Enterprise Channel builds): Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
- Office 2024 and Office 2021 Retail: Version 2610 (Build 20527.20196)
- Office LTSC 2024 Volume Licensed: Version 2408 (Build 17932.21140)
- Office LTSC 2021 Volume Licensed: Version 2108 (Build 14334.21048)
The LTSC builds here are the same as the MSRC fixed builds above. The release entry also lists an Office 2019 Volume Licensed build (Version 1808, Build 10417.20236), but MSRC does not list Office 2019 as affected by this CVE.
Bundled with other fixes
This is a cumulative Office update. The same November builds fix many other Word CVEs, including the neighbouring IDs CVE-2026-112714 through CVE-2026-112718, and also cover Excel, Outlook, PowerPoint, Visio, and Access. You cannot install the fix for this single CVE on its own. Moving to the listed build or later fixes this flaw and the others at once.
Verifying the fix
- Windows: open File > Account > About Word and compare the build with the channel list above.
- Mac: open Word > About Word and confirm the version is at least
16.115.26110837.
Click to Run installs normally update themselves. Volume-licensed LTSC installs only receive the fix when your update tooling (WSUS, Configuration Manager, Intune, and similar) deploys the November build. No CVE-specific workaround has been published. The official update is the supported remediation.
Affected systems and versions
From the affected product record Microsoft supplied for the CVE (upper bounds are excluded from the affected range):
- Microsoft 365 Apps for Enterprise (Windows, 32 bit and x64): starting at 16.0.1. The endpoint is given as an Office Security Releases reference rather than a single numeric build, so use the channel builds listed above.
- Microsoft Office LTSC 2021 (Windows, 32 bit and x64): 16.0.1 up to, but not including, 16.0.14334.21048
- Microsoft Office LTSC 2024 (Windows, 32 bit and x64): 16.0.0 up to, but not including, 16.0.17932.21140
- Microsoft Office 365 for Mac: 1.0.0 up to, but not including, 16.115.26110837
- Microsoft Office LTSC for Mac 2021: 16.0.1 up to, but not including, 16.115.26110837
- Microsoft Office LTSC for Mac 2024: 16.0.0 up to, but not including, 16.115.26110837
The vulnerable configuration is any of these installations below the fixed build, used to open an attacker-supplied file. MSRC does not list Office 2019 as affected.
Vendor security history
Microsoft is both the affected vendor and the assigning CNA. Its annual report describes Microsoft 365 Commercial as a productivity platform bringing together Office, Windows, Microsoft 365 Copilot, and Enterprise Mobility + Security, alongside Exchange, SharePoint, Teams, and security and compliance services. No Office market share figure or count of systems exposed to this CVE has been published.
The most substantive independent review of Microsoft's security practices in recent years is the Cyber Safety Review Board's March 20, 2024 report on the separate Summer 2023 Exchange Online intrusion, attributed to a group associated with the Chinese government. The board reported that email accounts belonging to 22 enterprise organizations were accessed, including government agencies and three think tanks. It concluded the intrusion was preventable and resulted from a cascade of avoidable Microsoft errors, including failures around key rotation and aging keys, and noted that Microsoft relied on a customer to detect anomalies. The board described Microsoft's security culture as inadequate.
In response to that period, Microsoft's Secure Future Initiative sets out three principles: secure by design, protections enabled and enforced by default, and continuously improved security controls and monitoring in operations. Its engineering commitments include improving code security, protecting engineering infrastructure, and timely vulnerability remediation, under a governance framework led by the company's CISO.
This history is background, and it did not cause this bug. The CSRB report's cloud identity findings do not explain the Word heap overflow, and the Secure Future Initiative's commitments do not by themselves demonstrate anything about this specific defect or about whether a given endpoint is patched.
References
- NVD: CVE-2026-112717
- Official CVE record: CVE-2026-112717 (CVE Services API)
- Microsoft Security Update Guide: CVE-2026-112717
- MSRC Security Update Guide API: affected products for CVE-2026-112717
- Release notes for Microsoft Office security updates
- MITRE CWE-122: Heap Based Buffer Overflow
- Update history for Office for Mac
- How to update Microsoft 365 or Office for Windows
- Update Office for Mac automatically
- Deploy updates for Office for Mac
- Zero Day Initiative: The November 2026 Security Update Review
- Cyber Safety Review Board: Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft Secure Future Initiative
- Microsoft 2026 Annual Report
