Brief Summary: Microsoft Word CVE-2026-112719 Heap Buffer Overflow Leading to Remote Code Execution

Introduction

A heap buffer overflow in Microsoft Office Word, fixed in Microsoft's November 10, 2026 Patch Tuesday release, gives an attacker a route to code execution on a Windows or Mac workstation as soon as a user opens a crafted document. The affected product list covers Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and three Office for Mac product families, so CVE-2026-112719 reaches both sides of a typical mixed Office estate. Microsoft reported no exploitation at release.

In this short review we summarize what Microsoft has actually published: the weakness class, the attack prerequisites, the fixed builds per servicing channel, and the exploitation status as of release day. We also flag where the public record stops.

Technical information

Root cause

Microsoft classifies the defect as CWE-122, Heap Based Buffer Overflow, in Microsoft Office Word. MITRE defines this weakness as a buffer overflow in which the overwritten buffer lives in heap memory, generally allocated through a routine such as malloc(). According to MITRE, this class of bug can lead to crashes or to arbitrary code execution, for instance by corrupting function pointers stored near the overflowed allocation.

Those are general characteristics of the weakness class. Microsoft has not disclosed which Word parser or record type was affected, the malformed file structure, the overflow offset, or any exploit chain. The affectedBinaries field in the MSRC data for this CVE is empty. Word is closed source, so there is no public commit or diff. Treat any function-level description of the code change from other sources as speculation unless it is backed by binary diffing.

Scoring

Microsoft's base vector, which NVD displays without an independent NIST score (the NVD record is marked Awaiting Analysis):

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H   (base 8.8, High)

The advisory's temporal vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C   (temporal 7.7)

Reading the components:

• AV:N: the malicious file can be delivered over a network.
• AC:L / PR:N: low attack complexity, no prior privileges needed.
• UI:R: a user must act, specifically by opening the file.
• S:U: scope unchanged.
• C:H / I:H / A:H: high potential impact across all three properties.
• E:U: exploit code maturity Unproven, which Microsoft defines as "No publicly available exploit code is available, or an exploit is theoretical."
• RL:O: an Official Fix exists, not merely a workaround.
• RC:C: report confidence Confirmed.

Microsoft's own severity label is Important, not Critical. The CVSS rating and the Microsoft severity rating are separate systems and should not be conflated.

Attack flow

Based on Microsoft's FAQ, the documented scenario is:

1. The attacker prepares a specially crafted file that triggers the heap overflow in Word.
2. The attacker provides that file to the target over the network.
3. The target opens the file. Microsoft states: "This attack requires a user to open a specially crafted file from the attacker to initiate remote code execution."
4. Opening the file triggers the heap memory corruption, which Microsoft rates as enabling code execution.

Network delivery alone does not satisfy the user interaction requirement. The file has to be opened. The Preview Pane is explicitly not an attack vector for this CVE, so Preview Pane claims made about other Office bugs should not be carried over. The advisory also does not list enabling macros or saving to another format as prerequisites.

Exploitation status at release

Microsoft's original advisory records Exploited: No, Publicly disclosed: No, and Exploitation Less Likely. The CVE record carries a CISA SSVC assessment, timestamped November 10, 2026 at 20:33 UTC, with Exploitation: none, Automatable: no, and Technical Impact: total.

No threat actor, campaign, targeted industry, file hashes, domains or IP addresses appear in the advisory or the CVE record, and we found no verified public proof of concept. These are publication-time assessments, not a guarantee about future activity. The high base score and the Less Likely assessment do not conflict. The score describes potential impact given the required user interaction, and the assessment describes observed and expected activity.

Patch information

Microsoft fixed CVE-2026-112719 in the November 10, 2026 Patch Tuesday release. The fix ships only as updated Office binaries. Every product in the MSRC record is marked productStatus: "fixed" and customerActionRequired: true, meaning a system is protected only once the new build is installed.

Fixed builds from MSRC affected product data

• Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140, documented in the Office security update release notes.
• Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048, documented in the Office security update release notes.
• Microsoft 365 Apps for Enterprise (x86/x64): channel-specific build listed at aka.ms/OfficeSecurityReleases, delivered via Click to Run channel updates.
• Office LTSC for Mac 2021 and 2024, Microsoft Office 365 for Mac: 16.115.26110837, documented in the Office for Mac release notes.

NVD lists the same thresholds: everything below these builds is affected.

How the fix reaches each channel

Modern Office installs use Click to Run, which does not ship separate per-CVE patches. Each month Microsoft releases a new cumulative build for every servicing channel. Microsoft's Office security release notes list CVE-2026-112719 under the Word section of the November 10, 2026 release, alongside many other Word CVEs fixed in the same builds. The November 10 builds are:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: 2610 (20527.20194), 2609 (20430.20264), 2608 (20326.20320)
• Semi Annual Enterprise Channel: 2610 (20527.20192), 2609 (20430.20262), 2608 (20326.20318)
• Office 2024 Retail and Office 2021 Retail: Version 2610 (Build 20527.20196)
• Office LTSC 2024 Volume Licensed: Version 2408 (Build 17932.21140)
• Office LTSC 2021 Volume Licensed: Version 2108 (Build 14334.21048)

The October 13, 2026 builds (LTSC 2024 17932.21056, LTSC 2021 14334.20974, Current Channel 20430.20182) are still vulnerable. Being current as of October is not enough. A machine is fixed only once its build matches or exceeds the November value for its channel. For Microsoft 365 Apps, check the installed build against the channel list rather than a single number.

Applying and verifying the update

• Office on Windows: in Word, select File > Account > Update Options > Update Now (select Enable Updates first if needed). If Update Options is missing, the install is likely volume licensed or managed by Group Policy. Use Microsoft Update or your organization's management tooling instead.
• Office for Mac from Microsoft: Help > Check for Updates > Update. If the control is missing, obtain the latest Microsoft AutoUpdate tool and check again.
• Mac App Store installs: open the Mac App Store, select Updates, then Update All or the individual app's Update button.
• Verification: in Word, go to File > Account > About Word and compare the build to the values above. At scale, inventory the Click to Run VersionToReport value. On macOS, confirm the app reports 16.115.26110837 or later.

Microsoft provides no CVE-specific workaround. MITRE's general CWE-122 controls (bounds checking, safer APIs, compiler overflow detection, ASLR) are software development measures with documented limitations, not alternatives to installing the fixed build.

Affected systems and versions

Per the Microsoft-supplied CVE record and NVD (upper bounds are exclusive):

• Microsoft 365 Apps for Enterprise (32 bit and x64): from 16.0.1; upper bound defined per channel in Office Security Releases rather than as one numeric build.
• Microsoft Office LTSC 2021 (32 bit and x64): 16.0.1 up to, but not including, 16.0.14334.21048.
• Microsoft Office LTSC 2024 (32 bit and x64): 16.0.0 up to, but not including, 16.0.17932.21140.
• Microsoft Office 365 for Mac: 1.0.0 up to, but not including, 16.115.26110837.
• Microsoft Office LTSC for Mac 2021: 16.0.1 up to, but not including, 16.115.26110837.
• Microsoft Office LTSC for Mac 2024: 16.0.0 up to, but not including, 16.115.26110837.

The vulnerable configuration is any of these installations where a user opens an attacker-supplied crafted file in Word. Preview Pane rendering is excluded.

Vendor security history

The most relevant independent assessment of Microsoft's security practices is the Cyber Safety Review Board's review of the summer 2023 Exchange Online intrusion. The Board found a "cascade of security failures at Microsoft" and concluded that its security culture was inadequate and required an overhaul. Specific findings included failures to detect compromised cryptographic material and a compromised employee laptop, failure to promptly correct inaccurate public statements, and the absence of automatic key rotation or alerts for aging keys that could have prevented an old signing key from remaining valid. The Board recommended direct CEO and board attention with a public reform plan and timelines.

Microsoft's July 2026 Secure Future Initiative progress report describes its response: broadly enforced Zero Trust controls for source code access, centrally governed build pipeline templates, and governance changes aimed at accountability. These are vendor-reported statements.

Neither document says anything about the cause of this Word memory corruption bug. The CSRB case concerns a cloud email intrusion, and SFI is not a technical validation of the Word fix. For CVE-2026-112719, the concrete evidence is the advisory, the official fix status and the fixed build numbers.

References

• Microsoft Security Update Guide: CVE-2026-112719
• NVD entry for CVE-2026-112719
• Official CVE record (CVE Services API)
• NVD API record
• MSRC API: vulnerability data
• MSRC API: affected product data
• Release notes for Microsoft Office security updates
• Release notes for Office for Mac
• Update history for Office LTSC 2024 and Office 2024
• Update history for Office LTSC 2021 and Office 2021
• How to update Microsoft 365 or Office for Windows
• Update Office for Mac automatically
• MITRE CWE-122: Heap Based Buffer Overflow
• Zero Day Initiative: The November 2026 Security Update Review
• BleepingComputer: Microsoft November 2026 Patch Tuesday coverage
• Microsoft SFI Progress Report, July 2026
• Microsoft 2026 Annual Report
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion