Overview of CVE-2026-112722: Heap-Based Buffer Overflow Enables Code Execution in Microsoft Office Word

Introduction

Microsoft's November 10, 2026 Patch Tuesday fixed a Word flaw that lets an attacker run code on a system as soon as a user opens a crafted document. The bug affects both Microsoft 365 Apps for Enterprise and several Office LTSC releases on Windows and Mac, so remediation has to be checked per product and per update channel rather than against a single build number.

CVE-2026-112722 carries a Microsoft-supplied CVSS 3.1 base score of 8.8 (High) and a temporal score of 7.7. Microsoft's own product severity is Important. NVD currently lists the record as Awaiting Analysis, so the 8.8 is Microsoft's assessment, not an independently completed NVD score. At original publication, Microsoft reported the issue as not publicly disclosed and not exploited, with an assessment of Exploitation Less Likely.

Technical information

Root cause classification

Microsoft assigns two weakness identifiers to this bug:

• CWE-122, Heap-based Buffer Overflow. MITRE defines this as writing beyond the end of a buffer allocated on the heap. Generic consequences include crashes, memory modification, and arbitrary code execution.
• CWE-197, Numeric Truncation Error. MITRE describes this as losing data when a primitive value is converted to a smaller type. The high-order bits are dropped and the result is an unexpected value. MITRE also documents generic cases where truncation leads to an undersized allocation and then an out-of-bounds write.

Taken together, the pairing points to a pattern that is common in file parsers. A length or count read from the document is stored in an integer type that is too narrow, so its high bits are lost. A heap buffer is then allocated using the truncated value, but later code copies or indexes data using the original, larger value. The write then runs past the end of the allocation.

This reading is an inference from the CWE pairing, not a disclosed root cause. The CVE record does not say whether, or exactly how, truncation causes this particular overflow. It also names no allocation calculation, integer width, function, parser, or file format.

Scoring and what it means

The Microsoft-supplied vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• Attack Vector: Network. The bug is classified as remotely reachable.
• Attack Complexity: Low. No special conditions beyond the crafted file are reflected in the score.
• Privileges Required: None. The attacker needs no prior access.
• User Interaction: Required. A user must open the crafted file.
• Scope: Unchanged.
• Confidentiality, Integrity, Availability: High for each.
• Exploit Code Maturity: Unproven. Microsoft defines this as no publicly available exploit code, or an exploit that remains theoretical.
• Remediation Level: Official Fix.
• Report Confidence: Confirmed.

Read the Network rating together with the user interaction requirement. It does not mean Word exposes a listening service, or that a system is compromised just by receiving a file.

Attack flow

Based on Microsoft's advisory, the disclosed sequence is:

1. The attacker prepares a specially crafted file designed to trigger the overflow in Word's file processing path.
2. The attacker gets the file to a victim. Microsoft does not specify a delivery mechanism or campaign.
3. The victim opens the file in Word.
4. Word parses the malformed content and the heap overflow occurs, which can lead to remote code execution.

Microsoft states that the Preview Pane is not an attack vector. The vulnerable code runs when Word opens and parses the document, not when it is previewed. Changing Preview Pane settings therefore does not remove the exposure.

The advisory does not provide any of the following:

• A file extension or malformed field layout
• A vulnerable function or payload
• A reproduction procedure or exploit source code

Nothing in the published material supports claims about sandbox escape, privilege escalation, or a specific exploit chain.

Exploitation status at publication

Microsoft's exploitability assessment, which applies at the time of original publication:

• Publicly disclosed: No
• Exploited: No
• Exploitation assessment: Exploitation Less Likely

The CISA Stakeholder Specific Vulnerability Categorization (SSVC) entry in the vulnerability record was captured at 20:32 UTC on November 10, 2026. It records:

• Exploitation: none
• Automatable: no
• Technical impact: total

The reviewed records name no threat actor or campaign. They provide no malicious document hashes, attacker infrastructure, detection signatures, or public exploit. Microsoft credits an Anonymous reporter, which is not attribution.

The high base score and the lower exploitation assessment answer different questions. The score describes what a successful attack could do. The assessment describes likelihood and observed activity at publication. Both are dated snapshots, not permanent guarantees.

Patch information

Microsoft fixed CVE-2026-112722 in its November 10, 2026 Patch Tuesday release, and the Security Update Guide marks the remediation level as Official Fix (RL:O).

• MSRC's API marks all nine product and architecture entries for this CVE as "productStatus":"fixed".
• Each entry also carries customerActionRequired: true.
• Word is closed source, so there is no public diff or commit. The fix ships only as updated Office builds.

What the fix most likely changes

Microsoft has not published technical details. Based on the CWE-122 and CWE-197 pairing, fixes for this class of bug typically do two things:

• Keep size values at full width from the moment they are parsed until the buffer is allocated.
• Check that the allocated size and the amount being copied match before writing to the heap.

This is an inference about the bug class, not a description of Microsoft's actual code change.

Fixed builds by product

• Office LTSC 2024 (32-bit and 64-bit): 16.0.17932.21140 (Version 2408)
• Office LTSC 2021 (32-bit and 64-bit): 16.0.14334.21048 (Version 2108)
• Office 365 for Mac, Office LTSC for Mac 2021 and 2024: 16.115.26110837 (Version 16.115)
• Microsoft 365 Apps for Enterprise (32-bit and 64-bit): MSRC lists aka.ms/OfficeSecurityReleases instead of a single build

Microsoft 365 Apps ships through several channels, so MSRC points to the Office security release notes rather than one build number. That page lists CVE-2026-112722 under its Word section for the November 10, 2026 release. The channel builds are:

• Current Channel: Version 2610, Build 20527.20196
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office 2024 and Office 2021 Retail: Version 2610, Build 20527.20196

The Office for Mac release notes also list CVE-2026-112722 under Word security updates for Version 16.115 (Build 26110837), released November 10, 2026.

The fix is present only once the installed Word build is at or above the fixed build for its channel. Releasing the update does not protect an endpoint until it moves to that build.

Applying the update

Windows:

1. Open an Office app such as Word and create a new document.
2. Select File > Account > Update Options > Update Now.
3. If Update Now is unavailable, Microsoft says Enable Updates may need to be selected first.

If Update Options is missing and only About appears, the installation may be managed through volume licensing or Group Policy. In that case, Microsoft's guidance is to try Microsoft Update or contact the company help desk.

Mac:

1. Open an app such as Word.
2. Select Help > Check for Updates, then Update.
3. Optionally, enable Automatically keep Microsoft apps up to date.

No documented workaround

The advisory contains no mitigation or workaround specific to this CVE. The sources do not establish any of the following as substitutes for the fix:

• Disabling macros
• Changing file associations
• Enabling a particular protection rule
• Disabling the Preview Pane

Affected systems and versions

The affected product records list builds below these boundaries as vulnerable, subject to the starting versions given in the record:

• Microsoft 365 Apps for Enterprise, Windows 32-bit and x64: vulnerable below the November 10, 2026 build for the installed channel (see the channel list above)
• Microsoft Office LTSC 2021, Windows 32-bit and x64: builds below 16.0.14334.21048
• Microsoft Office LTSC 2024, Windows 32-bit and x64: builds below 16.0.17932.21140
• Microsoft Office 365 for Mac: builds below 16.115.26110837
• Microsoft Office LTSC for Mac 2021: builds below 16.115.26110837
• Microsoft Office LTSC for Mac 2024: builds below 16.115.26110837

Two cautions apply when checking inventory:

• Do not substitute the LTSC threshold for Microsoft 365 Apps, which is fixed per channel.
• The November release notes mention other Office products. That is not evidence that every listed product is affected by this CVE.

Vendor security history

Microsoft's recent security record contains both independent criticism and company-reported reform. Neither one says anything about this specific Word defect.

Independent criticism. In its April 2, 2024 account, DHS described the Cyber Safety Review Board's finding that the Summer 2023 Exchange Online intrusion was preventable. The Board pointed to Microsoft decisions that together reflected a culture that deprioritized enterprise security investment and rigorous risk management. That incident was attributed to an actor assessed as affiliated with the People's Republic of China. Nothing connects that actor to this CVE.

Company-reported reform. Microsoft's July 10, 2026 Secure Future Initiative progress report describes:

• Revoking public access to more than 732,000 resources
• Decommissioning 1.4M unused applications
• Organizing the work around secure by design, secure by default, and secure in operations

These are Microsoft's own figures. They are not evidence that those measures prevented or detected this flaw.

Market context. The UK Competition and Markets Authority describes Microsoft's business software ecosystem as spanning a productivity software suite, PC and server operating systems, relational databases, and security software. A notice dated May 14, 2026 opened an initial investigation into whether Microsoft should receive strategic market status. This is not a completed designation, and it does not provide an Office market share figure.

References

• NVD: CVE-2026-112722
• CVE record (CVE Services API)
• Microsoft Security Update Guide: CVE-2026-112722
• MSRC affected product API for CVE-2026-112722
• NVD API record
• Release notes for Microsoft Office security updates
• Release notes for Office for Mac
• Zero Day Initiative: The November 2026 Security Update Review
• MITRE CWE-122: Heap-based Buffer Overflow
• MITRE CWE-197: Numeric Truncation Error
• How to update Microsoft 365 or Office for Windows
• Update Office for Mac automatically
• Microsoft Secure Future Initiative: July 2026 progress report
• DHS: Cyber Safety Review Board report on the Summer 2023 Microsoft Exchange Online incident
• Cybersecurity Dive: Inside Microsoft's security transformation
• UK CMA Investigation Notice
• UK CMA: Actions on cloud and business software