Brief Summary: CVE-2026-112721, a Heap Buffer Overflow in Microsoft Office Word Enabling Remote Code Execution

Introduction

Microsoft's November 10, 2026 Patch Tuesday fixed a heap-based buffer overflow in Word that can lead to code execution when a user opens a crafted document. Word sits on both Windows and Mac endpoints across subscription, LTSC, and retail editions, so the practical work for defenders is matching each installation to the correct fixed build rather than chasing a single version number.

Technical information

What Microsoft has confirmed

The official description reads: "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network." Microsoft's advisory FAQ narrows this considerably. Exploitation requires a user to open a specially crafted file supplied by the attacker, and the Preview Pane is not an attack vector. The advisory does not describe receiving or previewing a document as sufficient.

Microsoft, acting as the CNA, scores the flaw CVSS v3.1 8.8 (High):

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• AV:N, AC:L, PR:N: The attack can originate remotely, needs no special conditions, and needs no prior privileges.
• UI:R: A user action is required. Per the FAQ, that action is opening the crafted file.
• S:U: No change of security authority is scored.
• C:H/I:H/A:H: Potential high impact on confidentiality, integrity, and availability. These are potential consequences, not observed outcomes.

NVD lists the record as Awaiting Enrichment and has not supplied its own score. The temporal vector includes E:U (Unproven) and RL:O (Official Fix).

Root cause: what the weakness pairing suggests

Microsoft assigns two weakness IDs: CWE 122 (Heap Based Buffer Overflow) and CWE 197 (Numeric Truncation Error). MITRE describes CWE 197 as information loss when a value is converted to a smaller primitive type, and documents cases where a truncated length produces an undersized allocation followed by memory corruption. CWE 122 covers overflows of heap-allocated memory, which can crash the process or, in some circumstances, overwrite function pointers and redirect execution.

Taken together, the classifications point to a familiar file parser pattern:

1. Word reads a size or count field from the crafted document.
2. The value is narrowed into a smaller integer type (for example, from 32-bit to 16-bit), and the high bits are lost.
3. The truncated value sizes a heap allocation, so the buffer is too small.
4. The original, larger value still controls how much data is copied, so the copy writes past the end of the buffer.

Microsoft has not published the affected file format, the vulnerable parsing routine, the corrupted structure, or any exploit code. The sequence above is the bug class the CWE pairing describes. It is not a confirmed trace of Word's internals for this CVE.

Attack flow based on the published record

1. The attacker builds a document containing malformed size or length data targeting the vulnerable parse path.
2. The file is delivered to the target over a network channel (the AV:N rating).
3. The user opens the file in Word. Previewing it in the Preview Pane does not trigger the flaw.
4. During parsing, the truncation and overflow corrupt heap memory, which may allow attacker-controlled code execution with the high C/I/A impact Microsoft scores.

Patch information

Microsoft fixed CVE-2026-112721 in the November 10, 2026 release. Office is closed source, so the fix ships as updated binaries, with no public commit or diff. Microsoft's CVE record tags the MSRC advisory as both a vendor advisory and a patch reference. The advisory lists security updates for nine product rows (32-bit and 64-bit variants), all released November 10, 2026.

A fix for this bug class typically keeps the length at full width from parsing through allocation, or checks that the value fits the smaller type and the destination buffer before use. Microsoft has not confirmed which approach it took.

Fixed builds (first fixed version)

• Microsoft Office LTSC 2024 (32/64-bit): 16.0.17932.21140 (Version 2408)
• Microsoft Office LTSC 2021 (32/64-bit): 16.0.14334.21048 (Version 2108)
• Microsoft Office 365 for Mac: 16.115.26110837
• Microsoft Office LTSC for Mac 2024: 16.115.26110837
• Microsoft Office LTSC for Mac 2021: 16.115.26110837
• Microsoft 365 Apps for Enterprise (32/64-bit): per channel, see below

The CVE record gives no single fixed version for Microsoft 365 Apps. Its upper bound points to aka.ms/OfficeSecurityReleases because each channel gets its own build. The Office security release notes list CVE-2026-112721 under the Word heading for November 10, 2026:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel (receives Monthly Enterprise Channel builds): Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office 2024 / Office 2021 Retail: Version 2610 (Build 20527.20196)
• Office LTSC 2024 Volume Licensed: Version 2408 (Build 17932.21140)
• Office LTSC 2021 Volume Licensed: Version 2108 (Build 14334.21048)

The LTSC volume-licensed builds match the version limits in Microsoft's CVE record exactly, which indicates the fix is part of the November cumulative Office build rather than a standalone hotfix. An earlier upstream check reported the CVE under an Access heading. The current release notes place it under Word, consistent with the advisory title. Do not expand the affected inventory to Access on that basis.

Delivery and verification

• Click to Run Windows installs (Microsoft 365 Apps, Office 2021/2024, LTSC): The fix arrives through normal Office channel updates. A machine is patched once it is on the listed build or later for its channel.
• Mac: Office for Mac updates, for example through Microsoft AutoUpdate, to 16.115.26110837 or later.

Since this is a binary update, the practical check is the installed build number. On Windows, Word shows it under File > Account > About. Pick the build for the actual product and channel, because the largest build number does not apply to every installation.

Additional controls and their limits

• Protected View opens files from potentially unsafe locations, including certain internet files and Outlook attachments, with most editing functions disabled. Microsoft documents it as risk reduction, not as prevention of this CVE.
• The Defender ASR rule "Block all Office applications from creating child processes" interrupts a behavior commonly abused by Office malware. Legitimate applications may need child processes, and enforcement depends on Office being installed under %ProgramFiles% or %ProgramFiles(x86)%. For CVE-2023-36884, Microsoft reported this rule prevented exploitation in the attack chains it observed, but no comparable claim exists for CVE-2026-112721.

Neither control substitutes for the security update.

Affected systems and versions

The CVE record lists six product families:

• Microsoft 365 Apps for Enterprise: from 16.0.1. The upper boundary refers to the Office security releases page rather than a single numeric version (see channel builds above).
• Microsoft Office 365 for Mac: from 1.0.0, before 16.115.26110837
• Microsoft Office LTSC 2021: from 16.0.1, before 16.0.14334.21048
• Microsoft Office LTSC 2024: from 16.0.0, before 16.0.17932.21140
• Microsoft Office LTSC for Mac 2021: from 16.0.1, before 16.115.26110837
• Microsoft Office LTSC for Mac 2024: from 16.0.0, before 16.115.26110837

The vulnerable configuration is any of these installations in which a user opens an attacker-supplied document in Word.

Exploitation status

• MSRC: Exploited: No, Publicly disclosed: No, Exploitation Less Likely
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total
• OpenCVE: Reports the CVE is not in CISA KEV. No EPSS score is available (missing data is not the same as zero risk).
• Public reporting: No verified public exploit, indicators of compromise, or actor attribution have been identified.

Vendor security history

Word documents have a documented history of being weaponized against Microsoft customers. In June 2023, Microsoft identified a campaign by the actor it tracks as Storm 0978 (also known as RomCom) exploiting CVE-2023-36884 through Word documents using Ukrainian World Congress lures, targeting defense and government organizations in Europe and North America. NHS England independently described the delivery by malicious document and the requirement that the user open it. Microsoft later shipped updates that superseded the interim mitigations. This is relevant history, not evidence that Storm 0978 or anyone else is exploiting CVE-2026-112721.

At the organizational level, the Cyber Safety Review Board found the summer 2023 Exchange Online intrusion preventable and judged Microsoft's security culture inadequate. It also criticized Microsoft's failure to detect the compromise independently and its delay in correcting inaccurate public statements. Microsoft's July 2026 Secure Future Initiative report, by contrast, is the company's own account of progress: three objectives at target state, three nearing completion, twelve with significant progress, and 99.97% user and device coverage for phishing-resistant MFA. Neither document speaks to Word's memory handling for this CVE.

For scale, a UK Competition and Markets Authority investigation notice cites an 80% to 90% share of supply for Microsoft in the global productivity suite market. That figure is not a count of vulnerable installations, but it explains why Office servicing paths deserve careful tracking.

References

• NVD: CVE-2026-112721
• CVE Record: CVE-2026-112721
• MSRC Security Update Guide: CVE-2026-112721
• MSRC Advisory (portal)
• MSRC Advisory (en US)
• MSRC CVRF November 2026
• CVE Services API record
• Release notes for Microsoft Office security updates
• Office Security Releases (aka.ms)
• OpenCVE: CVE-2026-112721
• MITRE CWE 122: Heap Based Buffer Overflow
• MITRE CWE 197: Numeric Truncation Error
• FIRST CVSS v3.1 Specification
• Microsoft Support: What is Protected View?
• Microsoft Learn: ASR rules reference
• Microsoft Security Blog: Storm 0978 attacks reveal financial and espionage motives
• NHS England Digital cyber alert CC 4354
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft SFI Progress Report July 2026
• UK CMA Investigation Notice
• CISA Known Exploited Vulnerabilities Catalog
• BleepingComputer: Microsoft November 2026 Patch Tuesday coverage