Overview of CVE-2026-112723: Heap-Based Buffer Overflow in Microsoft Office Word Enabling Code Execution

Introduction

A heap-based buffer overflow in Microsoft Office Word, fixed in the November 2026 Patch Tuesday release, can let an attacker execute code on a workstation once a user opens a specially crafted document. Word runs on Windows and Mac endpoints across enterprise and consumer fleets, and Microsoft's CVSS assessment rates confidentiality, integrity, and availability impact as High, so this is an update worth tracking all the way to a verified installed build.

Technical information

Root cause

Microsoft and NVD describe CVE-2026-112723 as a heap-based buffer overflow in Microsoft Office Word that allows an unauthorized attacker to execute code over a network. The weakness is classified as CWE-122. The raw CVE data lists the vendor as Unknown, but the dedicated MSRC advisory makes clear that the affected vendor is Microsoft. NVD displays the Microsoft-supplied 8.8 High score. At the time of review, its record was awaiting enrichment and did not present a separate completed NVD assessment.

MITRE defines CWE-122 as a buffer overflow in which the overwritten buffer is allocated on the heap. Its general explanation notes that this kind of corruption can overwrite function pointers and redirect execution to attacker-controlled code. That describes the weakness class. Microsoft has not published an internal exploitation chain for this specific Word bug.

What Microsoft does not disclose is equally relevant for defenders:

• No vulnerable function or parser component is named.
• No malicious file format, delivery service, or macro requirement is specified.
• The privilege level of the resulting code execution is not stated.
• The affectedBinaries list in the MSRC API is empty for every affected product.

Word is closed source, so there is no public commit or diff to examine.

CVSS breakdown

Microsoft publishes the following CVSS 3.1 base vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The temporal suffix is:

E:U/RL:O/RC:C

• Attack vector, Network (AV:N): must be read together with the file-opening prerequisite.
• Attack complexity, Low (AC:L): Microsoft does not assign a high complexity requirement.
• Privileges required, None (PR:N): the attacker needs no prior privileges.
• User interaction, Required (UI:R): a user must open a specially crafted file.
• Scope, Unchanged (S:U): impact is confined to resources under the same security authority.
• Confidentiality, integrity, availability: High for each.
• Base score: 8.8. Temporal score: 7.7, which is separate and should not replace the base score.

Microsoft's separate product severity rating is Important. The 8.8 base score and the Important rating come from different classification systems, so they do not conflict.

Attacker authentication and victim interaction are separate questions here. The attacker needs no privileges, but exploitation still depends on the victim opening the file. Describing this simply as unauthenticated network code execution would omit a material prerequisite.

Attack flow

Based on Microsoft's advisory and FAQ, the documented sequence is:

1. The attacker constructs a specially crafted file designed to trigger the heap overflow in Word.
2. The attacker gets the file to a target user. No specific delivery mechanism is disclosed.
3. The user opens the file in Word. Microsoft states explicitly that the Preview Pane is not an attack vector, so previewing alone is not documented as sufficient.
4. Word processes the crafted content, heap memory is corrupted, and remote code execution can follow.

The Preview Pane exclusion narrows the documented exposure, but it does not make opening the file safe.

How this bug class is typically fixed (general context)

Microsoft has not described its code change. As general background only, a heap overflow in a document parser typically occurs when a length or count field read from a crafted file determines how much data is copied into a heap buffer that was allocated with a different size. Fixes usually validate the file-supplied size against the real allocation, or use overflow-safe size arithmetic, and reject the malformed structure instead of writing past the buffer. That pattern is consistent with Microsoft's statement that the user must open a specially crafted file, but it is not a confirmed description of this patch.

Exploitation status

Microsoft's release assessment states Publicly disclosed: No, Exploited: No, and Exploitation Less Likely. The CVE record also carries CISA SSVC enrichment: exploitation none, automatable no, technical impact total. The temporal vector includes E:U, and we did not identify an independently confirmed public proof of concept in the reviewed material. No threat actor, campaign, or indicators of compromise are named. These are assessments made at disclosure. They describe the situation on November 10, 2026, and do not guarantee what follows.

Patch information

Microsoft shipped the official fix on November 10, 2026, as part of the November Patch Tuesday release (releaseNumber: 2026-Nov). Every affected product in the Security Update Guide is marked productStatus: "fixed" with customerActionRequired: true. The temporal vector reflects this with RL:O (Remediation Level: Official Fix).

The fix ships as updated Office binaries in new Office builds. Because the advisory names no binaries, the only way to confirm protection is to verify that Office is running at or above the fixed build for its product and channel.

Fixed builds by product

• Microsoft Office LTSC 2021 (32-bit and 64-bit): 16.0.14334.21048 (Version 2108)
• Microsoft Office LTSC 2024 (32-bit and 64-bit): 16.0.17932.21140 (Version 2408)
• Microsoft Office 365 for Mac: 16.115.26110837
• Microsoft Office LTSC for Mac 2021: 16.115.26110837
• Microsoft Office LTSC for Mac 2024: 16.115.26110837
• Microsoft 365 Apps for Enterprise (32-bit and 64-bit): depends on update channel. MSRC points to Office Security Releases

The three Mac products share one build because Office for Mac ships on a single build line, with the LTSC SKUs as licensing variants. Do not substitute one Windows product's build for another product's requirement.

Microsoft 365 Apps channel builds

The Release notes for Microsoft Office security updates page was updated November 10, 2026 and lists CVE-2026-112723. Its November 10 entry gives the following builds:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel (listed as receiving Monthly Enterprise Channel builds): Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office 2024 Retail / Office 2021 Retail: Version 2610 (Build 20527.20196)
• Office LTSC 2024 Volume Licensed: Version 2408 (Build 17932.21140)
• Office LTSC 2021 Volume Licensed: Version 2108 (Build 14334.21048)

This channel list was gathered through automated extraction from the release notes page, so confirm it against the page itself before setting compliance baselines. The LTSC builds match the MSRC data exactly. A Click to Run build such as 20527.20196 corresponds to the full 16.0.x.y version string.

Delivery

• Windows Click to Run (Microsoft 365 Apps, retail Office 2021 and 2024, volume-licensed LTSC 2021 and 2024): the fix arrives through Office's built-in update channel. Each MSRC entry links to the Office security release notes rather than a separate MSI or KB installer. Microsoft documents that Microsoft 365 Apps updates are not supplied through Windows Update. They are published through the Office CDN. Microsoft recommends that devices update directly from the CDN and supports Configuration Manager as a management option.
• Mac (Office 365 for Mac, LTSC for Mac 2021 and 2024): the fix arrives through Microsoft AutoUpdate. MSRC links to the Office for Mac release notes as both the article and the download.

Applying and verifying

• Office on Windows: open an Office application, create a document, and select File > Account > Update Options > Update Now, selecting Enable Updates first if needed. If Update Options is unavailable, volume licensing or Group Policy may be controlling updates.
• Office on Mac: open an Office application and select Help > Check for Updates. Administrators can also deploy application update packages through existing software deployment tools.

Microsoft separates updating into detection, download, and application, and states that an update cannot be applied while an Office program that requires it is in use. The scheduled task retries later. A completed download therefore does not prove the fix is installed. Check the installed build under File > Account, in the About information, and compare it with the fixed build for the device's product or channel.

Workarounds and publication notes

The advisory provides no specific workaround. It does not establish macro disabling, registry changes, firewall rules, or detection signatures as remedies for this CVE.

Microsoft's published sources disagree in two places. The shared Office security release page lists this CVE under an Access heading, while the dedicated MSRC and NVD records identify Word. The Mac release notes page we reviewed did not yet contain the November build listed in the advisory. The product identity and fixed builds above follow the dedicated MSRC advisory.

The advisory is at revision 1.0 (November 10, 2026, "Information published") with no subsequent changes to the fix.

Affected systems and versions

Per the CNA data on NVD and the MSRC advisory:

• Microsoft Office LTSC 2021, 32-bit and 64-bit: 16.0.1 up to, but not including, 16.0.14334.21048
• Microsoft Office LTSC 2024, 32-bit and 64-bit: 16.0.0 up to, but not including, 16.0.17932.21140
• Microsoft Office 365 for Mac: 1.0.0 up to, but not including, 16.115.26110837
• Microsoft Office LTSC for Mac 2021: 16.0.1 up to, but not including, 16.115.26110837
• Microsoft Office LTSC for Mac 2024: 16.0.0 up to, but not including, 16.115.26110837
• Microsoft 365 Apps for Enterprise, 32-bit and 64-bit: 16.0.1 up to, but not including, the fixed build for the device's update channel

Exploitation requires a user to open a crafted file in an affected Word installation, and the Preview Pane is not a documented attack vector.

Vendor security history

Microsoft's annual report positions Microsoft 365 Commercial as a productivity platform combining Office, Windows, Microsoft 365 Copilot, and Enterprise Mobility + Security, with Office available both as cloud services and as locally licensed software for commercial and consumer customers. The affected product list here reflects that spread across subscription apps, perpetual LTSC releases, and Mac editions.

Follina (CVE-2022-30190) makes a useful historical contrast. It was a Microsoft Support Diagnostic Tool vulnerability that could be invoked through an application such as Word. Australia's ACSC observed active exploitation against Australian organizations and reported that public proof-of-concept code had entered common exploitation tools. Microsoft patched it through the June 2022 cumulative Windows updates, and ACSC explicitly warned that disabling Office macros did not prevent exploitation. Follina is a different bug class in a different component and is not evidence of exploitation of CVE-2026-112723. It does illustrate why Office-related issues need vulnerability-specific responses rather than generic assumptions about macros.

On the engineering side, Microsoft's July 2026 Secure Future Initiative report describes applying Zero Trust across engineering pipelines, platform controls, and governance, including broader Zero Trust enforcement for source code access and centrally governed templates in 93% of critical and high-value build pipelines. These are vendor-reported figures, not independent evidence about the safety of Word's file processing, and Microsoft itself frames security as a continuous discipline.

References

• NVD: CVE-2026-112723
• CVE Record via CVE Services API: CVE-2026-112723
• Microsoft Security Update Guide: CVE-2026-112723
• MSRC API: affected product data for CVE-2026-112723
• Release notes for Microsoft Office security updates
• Office Security Releases
• Release notes for Office for Mac
• How to update Microsoft 365 or Office for Windows
• Overview of the update process for Microsoft 365 Apps
• MITRE CWE-122: Heap based Buffer Overflow
• Cyber.gov.au: Exploitation of Microsoft Office vulnerability, Follina
• CISA: Microsoft Releases Workaround Guidance for MSDT Follina Vulnerability
• Microsoft Trust Center: SFI Progress Report July 2026
• Microsoft 2026 Annual Report
• BleepingComputer: Microsoft November 2026 Patch Tuesday coverage