Brief Summary: Microsoft Word CVE-2026-112724 Heap-Based Buffer Overflow Leading to Remote Code Execution

Introduction

A heap-based buffer overflow in Microsoft Office Word, fixed in the November 10, 2026 Patch Tuesday release, gives an attacker a path to code execution on an unpatched system when a user opens a crafted document. The affected product list spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and three Office for Mac SKUs, so most of the practical work for defenders lies in matching the correct fixed build to each product and servicing channel.

Microsoft, the CNA for this record (the vendor field in the raw CVE data reads Unknown, which is incorrect), scores CVE-2026-112724 at CVSS 3.1 8.8 (High) and classifies it as Important. At publication, Microsoft reported no public disclosure and no exploitation, and assessed exploitation as Less Likely. This post reviews what the advisory and related records establish, and what they leave unstated.

Technical information

Root cause

Microsoft identifies the weakness as CWE-122, Heap based Buffer Overflow, in Microsoft Office Word. MITRE defines this class as a buffer overflow in which the overwritten buffer was allocated on the heap. General consequences of the class include memory modification, crashes, and arbitrary code execution. Those are properties of the weakness category, not confirmed details of a specific Word exploit.

Word is closed source, and Microsoft has not published a diff, commit, or root-cause write-up. The advisory does not disclose the affected parser, internal function, file structure, or memory-corruption sequence. No vulnerable code snippet is publicly available, so none is reproduced here.

What the vendor material does establish:

• The bug is a heap overflow in Word.
• It is triggered when a user opens a specially crafted file.
• The Preview Pane is not an attack vector.

The Preview Pane exclusion suggests the vulnerable code runs when Word fully opens a document, not in the preview renderer.

CVSS interpretation

The base vector reported by NVD (Microsoft's CNA assessment) is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• AV:N (Network): classified as remotely reachable, subject to the file-opening requirement.
• AC:L (Low): no high attack complexity is assigned.
• PR:N (None): the attacker needs no prior privileges to initiate the attack.
• UI:R (Required): a user must open the crafted file.
• S:U (Unchanged): no scope change is assigned.
• C:H / I:H / A:H: confidentiality, integrity, and availability impacts are all rated High.

PR:N describes the attacker's prerequisites. It does not mean resulting code runs as an administrator or SYSTEM, and the advisory does not specify the execution context. Microsoft also publishes a temporal extension ending in E:U/RL:O/RC:C (Unproven exploit maturity, Official Fix, Confirmed report confidence), which produces a temporal score of 7.7. That should not be confused with the 8.8 base score.

Attack flow

Based on Microsoft's documented exploitation sequence:

1. The attacker prepares a specially crafted file designed to trigger the heap overflow in Word.
2. The attacker supplies that file to a target user. The advisory does not specify a delivery channel.
3. The user opens the file in an affected, unpatched Word installation. Merely displaying the file in the Preview Pane is not an attack vector.
4. Processing the file overflows a heap buffer, and successful exploitation results in code execution, with High potential impact to confidentiality, integrity, and availability.

The Network classification and the required user interaction fit together: the documented exposure is opening an attacker-supplied file, not simply receiving or previewing it.

Exploitation status at publication

Microsoft's publication-time assessment:

• Publicly disclosed: No
• Exploited: No
• Exploitability: Exploitation Less Likely
• Exploit code maturity: Unproven (no publicly available exploit code, or an exploit that is theoretical)

The CISA ADP Stakeholder Specific Vulnerability Categorization (SSVC) entry dated November 10, 2026 records Exploitation as none, Automatable as no, and Technical Impact as total. Neither Microsoft nor CISA associates a threat actor, campaign, malware family, targeted sector, sample, hash, or command-and-control indicator with this CVE. NVD lists the record as Awaiting Enrichment and has not yet provided its own score.

The evidence supports "not known to be exploited at publication," not "cannot be exploited." High potential impact and an absence of observed exploitation are separate findings and are not contradictory.

Patch information

Microsoft released the official fix on November 10, 2026 as part of that month's Patch Tuesday. The MSRC advisory sets the CVSS temporal Remediation Level to Official Fix (RL:O), meaning a complete vendor fix exists. Microsoft's Office security release notes list CVE-2026-112724 under the Word heading for November 10, 2026, alongside dozens of other Word CVEs fixed in the same release.

MSRC does not list a standalone KB article for this CVE. Every Windows row links to the general Office security release notes. Windows Click to Run installs receive the fix through Office's built-in updater or the organization's configured deployment channel. Mac builds are distributed under the Office for Mac release notes that MSRC links for each Mac SKU.

Fixed builds by product

MSRC and NVD give the same version boundaries. Builds below these numbers are vulnerable:

• Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140
• Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048
• Microsoft Office 365 for Mac: 16.115.26110837
• Microsoft Office LTSC for Mac 2024: 16.115.26110837
• Microsoft Office LTSC for Mac 2021: 16.115.26110837
• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): channel dependent; MSRC points to Microsoft Office Security Releases

Click to Run channel builds for Microsoft 365 Apps

Microsoft 365 Apps updates through several servicing channels, so there is no single fixed build. The November 10, 2026 release notes list these patched builds:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: 2610 (Build 20527.20194), 2609 (Build 20430.20264), 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel: 2610 (Build 20527.20192), 2609 (Build 20430.20262), 2608 (Build 20326.20318)
• Office 2024 Retail / Office 2021 Retail: Version 2610 (Build 20527.20196)
• Office LTSC 2024 Volume Licensed: Version 2408 (Build 17932.21140)
• Office LTSC 2021 Volume Licensed: Version 2108 (Build 14334.21048)

The LTSC volume-licensed builds match the MSRC table (17932.21140 and 14334.21048), which confirms that the advisory and the release notes describe the same update.

Applying the update

Windows (Microsoft 365 and Office):

1. Open an Office application such as Word and create a new document.
2. Select File > Account.
3. Under Product Information, select Update Options > Update Now.
4. If necessary, select Enable Updates first, then Update Now.

If Update Options is missing and only About appears, the installation may use volume licensing or Group Policy managed updates. Microsoft's guidance in that case is to try Microsoft Update or contact the organization's help desk.

Mac (Microsoft AutoUpdate):

1. Open an Office application such as Word.
2. Select Help > Check for Updates.
3. Select Update to download and install available updates.
4. Optionally select Automatically keep Microsoft apps up to date.

For apps installed from the Mac App Store, use App Store > Updates, then Update All or the update button next to the relevant app.

Confirming the patch is installed

The fix is defined by build number, so verification is a version comparison against the tables above:

• Windows: File > Account > About Word shows the installed version and build.
• Mac: Word > About Word shows the version.

A host reporting a build at or above the fixed value for its product or channel has the November 10, 2026 Word fix.

Workarounds and what the patch changes

The advisory provides no dedicated workaround. The statement that the Preview Pane is not an attack vector clarifies exposure. It is not an alternative to patching.

As general background only, and not confirmed by Microsoft for this CVE: CWE-122 fixes in document parsers usually add or correct a length or bounds check before file data is copied into a heap buffer, or correct how the buffer size is calculated (for example, an integer overflow in the allocation size). Microsoft has not said which, if either, applies here.

Affected systems and versions

Per MSRC and NVD, the following installations are vulnerable:

• Microsoft Office LTSC 2024 for Windows (32 bit and 64 bit): builds below 16.0.17932.21140 (Volume Licensed Version 2408, Build 17932.21140 is fixed)
• Microsoft Office LTSC 2021 for Windows (32 bit and 64 bit): builds below 16.0.14334.21048 (Volume Licensed Version 2108, Build 14334.21048 is fixed)
• Microsoft Office 365 for Mac: versions below 16.115.26110837
• Microsoft Office LTSC for Mac 2024: versions below 16.115.26110837
• Microsoft Office LTSC for Mac 2021: versions below 16.115.26110837
• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): builds older than the patched build for the relevant servicing channel (Current, Monthly Enterprise, or Semi Annual Enterprise), as listed in the Patch Information section

The vulnerable configuration is an affected Word installation in which a user opens an attacker-supplied crafted file. The advisory does not quantify how many installations are exposed.

Vendor security history

Microsoft's broad productivity footprint is part of why accurate product identification matters for this CVE. In June 2024, the European Commission preliminarily found Microsoft dominant worldwide in SaaS productivity applications for professional use. The Commission noted that its Statement of Objections did not prejudge the outcome, and it was a competition assessment, not a security finding. In May 2026, the UK Competition and Markets Authority opened a strategic market status investigation into Microsoft's business software ecosystem, covering productivity, operating systems, databases, and security software. An investigation is not a finding of wrongdoing.

On security practice, the most significant independent assessment is the Cyber Safety Review Board's review of the 2023 Microsoft Exchange Online intrusion. According to DHS, the Board concluded the intrusion was preventable and identified operational and strategic decisions pointing to a corporate culture that deprioritized enterprise security investment and rigorous risk management. The Board recommended a public plan for fundamental security reforms, and DHS stated that Microsoft fully cooperated with the review. That incident concerned Exchange Online and has no established connection to CVE-2026-112724.

Microsoft describes its Secure Future Initiative, launched in November 2023, as a multiyear effort built on Secure by Design, Secure by Default, and Secure Operations. These are vendor commitments rather than independent evidence about any specific product flaw. For this CVE, the specific advisory remains the authoritative source.

References

• NVD: CVE-2026-112724
• CVE record for CVE-2026-112724 (CVE Services API)
• Microsoft Security Update Guide: CVE-2026-112724, Microsoft Office Word Remote Code Execution Vulnerability
• Release notes for Microsoft Office security updates (Microsoft Learn)
• Microsoft Office Security Releases (aka.ms)
• Update history for Office LTSC 2024 and Office 2024 (Microsoft Learn)
• Release notes for Office for Mac (Microsoft Learn)
• How to update Microsoft 365 or Office for Windows (Microsoft Support)
• Update Office with Microsoft Update (Microsoft Support)
• Update Office for Mac automatically (Microsoft Support)
• CWE 122: Heap based Buffer Overflow (MITRE)
• BleepingComputer: Microsoft November 2026 Patch Tuesday coverage
• Secure Future Initiative, Secure by Design (Microsoft)
• Microsoft 2026 Annual Report
• Cyber Safety Review Board report on the Microsoft Exchange Online incident (DHS)
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion (PDF)
• European Commission: Statement of Objections to Microsoft
• CMA strategic market status investigation into Microsoft's business software ecosystem (GOV.UK)