Introduction
Microsoft's November 10, 2026 Patch Tuesday release fixed a heap buffer overflow in Microsoft Office Word that can lead to code execution when a user opens a specially crafted file. The affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and several Office for Mac releases, so remediating CVE-2026-112718 comes down to matching each installed product and update channel to the correct fixed build.
Microsoft, acting as the CNA, assigns a CVSS v3.1 base score of 8.8, which NVD classifies as High. Microsoft's own maximum severity rating is Important. The two labels come from different rating systems, so they do not conflict. At original publication Microsoft reported the issue as not publicly disclosed, not exploited, and "Exploitation Less Likely." The source CVE data lists the vendor as "Unknown," but the MSRC advisory confirms the vendor is Microsoft.
Technical information
Root cause
The vulnerability is classified as CWE 122, Heap based Buffer Overflow. MITRE defines this weakness as an overflow of a buffer allocated in the heap portion of memory, for example through a routine such as malloc(), and notes that heap overflows can enable arbitrary code execution, including through corruption of function pointers. That is a general description of the weakness class. Microsoft has not said that this specific mechanism applies here.
Word is closed source, and Microsoft has published no source diff, commit, or code-level root cause write-up. The public advisory does not identify:
- the vulnerable function or Word component
- the malformed document fields or record type
- the exact file format involved
- the heap corruption layout
- any mitigation bypass technique
As background on the bug class only: a heap overflow in a document parser usually means Word trusts some length, count, or offset taken from the crafted file when it copies data into a heap allocation. Fixes for this class typically add bounds or size validation before the copy, or correct how the destination buffer is sized. Microsoft has not confirmed which of these, if either, describes the CVE-2026-112718 fix.
CVSS breakdown
Microsoft's full published vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
The base score is 8.8 and the temporal score is 7.7. NVD attributes the base assessment to Microsoft as CNA and does not supply a separate NIST score.
- Attack Vector: Network. The attacker is remote.
- Attack Complexity: Low. The base assessment includes no specialized access conditions. This does not mean reliable exploitation has been observed.
- Privileges Required: None. The attacker needs no prior authorization.
- User Interaction: Required. A user must open the crafted file.
- Scope: Unchanged. Impact remains within the same security authority.
- Confidentiality, Integrity, Availability: High. Serious potential disclosure, modification, or denial of access to affected resources.
- Exploit Maturity: Unproven (E:U). Microsoft defines this as no publicly available exploit code, or a theoretical exploit.
- Remediation Level: Official Fix (RL:O). "A complete vendor solution is available."
- Report Confidence: Confirmed (RC:C).
A Network attack vector with Required user interaction is consistent with the advisory, which describes a remote attacker supplying a file rather than an automatically exploitable listening service.
Attack flow
Based on the MSRC FAQ, the documented path looks like this:
- The attacker prepares a specially crafted file designed to trigger the heap overflow in Word.
- The attacker gets that file to the target. Microsoft does not identify a specific delivery channel such as email or a particular website.
- The user opens the file in an affected Word build. Microsoft explicitly states that the Preview Pane is not an attack vector, so merely previewing the content does not trigger the issue.
- Word processes the crafted content and the heap overflow occurs, which can result in code execution within the same security authority (Scope Unchanged), with high confidentiality, integrity, and availability impact.
The published metrics do not establish automatic administrator access or compromise of every resource on the device. The public evidence also does not support claims about a macro requirement, a particular payload, or a reconstructed exploit chain.
Exploitation status
Microsoft's exploitability table, which it describes as its assessment at the time of original publication, reports:
- Publicly disclosed: No
- Exploited: No
- Exploitability: Exploitation Less Likely
Microsoft credits "Anonymous" and "LC with VGCO Future Labs" through coordinated vulnerability disclosure. Those credits acknowledge researchers and attribute nothing to a threat actor. Neither party has published technical details. The advisory names no attacker, campaign, or malware family and publishes no samples or indicators of compromise. We could not determine from the available material whether CVE-2026-112718 is in the CISA KEV catalog.
The 8.8 base score measures potential consequences, while the "Exploitation Less Likely" forecast measures the assessed likelihood of exploitation. Neither removes the need to apply the fix.
Patch information
Microsoft fixed CVE-2026-112718 in the November 10, 2026 Patch Tuesday release. The public record of the fix is the set of patched build numbers, and you can confirm remediation by comparing installed builds against them. MSRC lists nine affected product rows, all released November 10, 2026, and NVD shows versions below these builds as affected.
Fixed builds by product
- Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140 (Version 2408)
- Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048 (Version 2108)
- Microsoft Office 365 for Mac: 16.115.26110837
- Microsoft Office LTSC for Mac 2021 and 2024: 16.115.26110837 (Version 16.115, Build 26110837)
- Microsoft 365 Apps for Enterprise (32 bit and 64 bit): channel dependent, with MSRC pointing to aka.ms/OfficeSecurityReleases
Microsoft 365 Apps channel builds
Microsoft's Office security release notes list CVE-2026-112718 under Word for November 10, 2026, with these builds:
- Current Channel: Version 2610 (Build 20527.20196)
- Monthly Enterprise Channel: 2610 (Build 20527.20194), 2609 (Build 20430.20264), 2608 (Build 20326.20320)
- Semi Annual Enterprise Channel (receives Monthly Enterprise builds): 2610 (Build 20527.20192), 2609 (Build 20430.20262), 2608 (Build 20326.20318)
- Office 2024 and Office 2021 Retail: Version 2610 (Build 20527.20196)
The Office for Mac release notes also list this CVE under Word security updates for Version 16.115 (Build 26110837).
Delivery mechanisms
The fix ships only through the Click to Run channel builds above and through Microsoft AutoUpdate (MAU) on macOS. There is no standalone MSI patch. Microsoft's November 2026 Office update index (KB5134569) lists MSI packages only for SharePoint Server Subscription Edition (KB5002945) and Office Online Server (KB5002946), and neither is tied to this Word CVE.
Windows (Click to Run): Office applies the update automatically, or you can trigger it manually. Open Word, create a new document, and select File > Account > Update Options > Update Now (select Enable Updates first if needed). If Update Options is unavailable because updates are centrally managed or the installation is volume licensed, Microsoft advises contacting your help desk or using Microsoft Update. To verify, confirm the build shown under File > Account is at or above the fixed build for your channel.
Managed Microsoft 365 deployments: Microsoft documents automatic updating and administrator controls through Group Policy or the Office Deployment Tool, and recommends obtaining updates directly from the Office CDN. You can configure update deadlines, but Microsoft warns that forced application closure at a deadline can cause data loss.
Mac: In Word, select Help > Check for Updates, enable Automatically keep Microsoft apps up to date, and select Update. For apps installed from the Mac App Store, use the App Store Updates page. Microsoft notes that updates require macOS 14 (Sonoma) or later, so older Macs will not receive this fix.
Workarounds and related CVEs
The advisory publishes no CVE-specific workaround. The Preview Pane statement clarifies exposure and does not replace the update.
CVE-2026-112718 sits in a block of neighbouring Word RCE CVEs (CVE-2026-112714 through CVE-2026-112741, among others) fixed by the same builds. One update closes all of them, which also means the build number cannot tell you which individual Word flaw a given code change addressed.
One upstream report tied this CVE to a Xen Orchestra authentication bypass fix from Vates. None of the fetched sources support that link. CVE-2026-112718 is a Microsoft Word vulnerability only.
Affected systems and versions
The affected ranges below come from NVD's Microsoft-supplied product data:
- Microsoft 365 Apps for Enterprise (Windows, 32 bit and 64 bit): from 16.0.1, with the upper boundary referring to Office security releases rather than a single numeric build
- Microsoft Office 365 for Mac: from 1.0.0, before 16.115.26110837
- Microsoft Office LTSC 2021 (Windows, 32 bit and 64 bit): from 16.0.1, before 16.0.14334.21048
- Microsoft Office LTSC 2024 (Windows, 32 bit and 64 bit): from 16.0.0, before 16.0.17932.21140
- Microsoft Office LTSC for Mac 2021: from 16.0.1, before 16.115.26110837
- Microsoft Office LTSC for Mac 2024: from 16.0.0, before 16.115.26110837
The Windows LTSC and Mac builds belong to separate release lines and are not interchangeable installation targets. Macs running a macOS version earlier than 14 cannot receive the fixed Mac build.
Vendor security history
The European Commission describes Microsoft's productivity ecosystem as including Word, Excel, PowerPoint, and Outlook, and in its Teams proceedings preliminarily found Microsoft dominant in the worldwide market for SaaS productivity applications for professional use. That is a qualified regulatory finding rather than a market-share figure, but it shows how broad Word exposure is likely to be across Windows and Mac fleets.
The Cyber Safety Review Board's review of the summer 2023 Exchange Online intrusion concluded that the intrusion was preventable, that Microsoft's security culture required an overhaul, and that there were failures in detection, key protection, and risk management, including reliance on a customer to identify anomalies. The Board also criticized Microsoft for leaving an unsupported crash dump theory about the signing key acquisition uncorrected for an extended period. This was an Exchange Online incident and is not evidence of exploitation of CVE-2026-112718.
Microsoft launched its Secure Future Initiative in November 2023 around secure by design, secure by default, and secure operations principles. Its July 2026 progress report states that source code access broadly enforces Zero Trust, that 93% of critical and high-value build pipelines use centrally governed templates, and that automated container patching addresses approximately 3 million vulnerability instances each month. These are vendor-reported outcomes, not independent certification of Word, and a newly disclosed memory corruption bug in Word can coexist with them. For this CVE, the concrete assurance is the published fixed build.
References
- NVD entry for CVE-2026-112718
- CVE Record: CVE-2026-112718
- Microsoft Security Update Guide: CVE-2026-112718
- Release notes for Microsoft Office security updates
- Release notes for Office for Mac
- Microsoft KB5134569: November 2026 Office updates
- ZDI: The November 2026 Security Update Review
- How to update Microsoft 365 or Office for Windows
- Keep Office apps up to date with the latest updates
- Update Office for Mac automatically
- MITRE CWE 122: Heap based Buffer Overflow
- CISA Known Exploited Vulnerabilities Catalog
- Casco: CVE-2026-112718 Microsoft Office Word Remote Code Execution Vulnerability
- CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft Secure Future Initiative
- SFI Progress Report July 2026
- European Commission Decision Summary, Microsoft Teams cases
