CVE-2026-112726: Heap buffer overflow leading to remote code execution in Microsoft Word

Introduction

Microsoft's November 10, 2026 security release fixes a memory corruption flaw in Word that can lead to code execution when a user opens a crafted document. Word ships in Microsoft 365 Apps and Office LTSC on both Windows and Mac, and the European Commission describes these as widely used business productivity suites. A parser-level heap overflow in Word is therefore relevant wherever those suites are deployed.

Microsoft scores the issue at CVSS 3.1 8.8 (High) and rates it Important. At publication it reported the bug as not exploited and not publicly disclosed, and assessed it as Exploitation Less Likely. The NVD entry lists the vendor as Unknown, but the MSRC advisory makes clear this is Microsoft Office Word. Microsoft is also the CNA that supplied the record. NVD marks the entry Awaiting Enrichment, so the 8.8 score comes from Microsoft and is not an independent second rating.

Technical information

Root cause as disclosed

Microsoft says only that a heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. The record carries two weakness classes:

• CWE-122, Heap based Buffer Overflow. MITRE defines this as an overflow in which the overwritten buffer lives in heap memory. General consequences include crashes and arbitrary code execution, for example through corruption of function pointers held in adjacent heap data.
• CWE-197, Numeric Truncation Error. This covers converting a value into a smaller primitive type, which loses data. MITRE notes that the truncated result may then be used as a buffer index, a loop iterator, or other program state.

Microsoft has not said how the two weaknesses relate in this bug. It has not named the file format, the parser component, the vulnerable function, or the heap objects involved. Word is closed source, so there is no public diff or commit to inspect.

What the CWE pairing suggests

The combination of truncation and heap overflow matches a well-known parser bug pattern:

1. Word reads a length, count, or offset field from the document.
2. That value is narrowed into a smaller integer type. For example, a 32-bit size stored into a 16-bit field silently loses its high bits.
3. The truncated value sizes a heap allocation.
4. The full-width value, or a different value, controls how much data is copied into that allocation.
5. The copy writes past the end of the buffer.

The usual fix for this pattern is to use one consistent integer width for both the size calculation and the copy length, or to reject values that do not fit before narrowing them. This is our inference from the CWE pairing, not a confirmed detail of the patch. Two CWE labels alone do not prove that a truncated allocation length causes this specific overflow, and Microsoft has not described the causal chain.

CVSS breakdown

Microsoft publishes the following base vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The temporal score is 7.7, and the extended vector ends in E:U/RL:O/RC:C, meaning exploit code maturity Unproven, Remediation Level Official Fix, and Report Confidence Confirmed.

• Attack Vector: Network. Microsoft classifies delivery as network based, but this has to be read together with the user interaction requirement.
• Attack Complexity: Low. Microsoft scores no special attack conditions.
• Privileges Required: None. The attacker needs no prior access.
• User Interaction: Required. A user must open the crafted file.
• Scope: Unchanged.
• Confidentiality, Integrity, Availability: High. These ratings describe potential impact rather than observed damage.

So the attacker needs no privileges, but the victim still has to take part. An attacker on the network cannot trigger this without someone opening the file.

Attack flow

Based on the advisory, the documented scenario is:

1. The attacker prepares a specially crafted file that triggers the heap overflow when Word processes it.
2. The attacker delivers the file to a target. The advisory does not specify the delivery channel or a required file extension.
3. The target opens the file in Word. Viewing the file in the Preview Pane is explicitly not an attack vector.
4. Word parses the malicious content and overflows a heap buffer, which can lead to execution of attacker-controlled code.

The advisory does not mention a macro requirement or any security feature bypass as part of the chain.

Exploitation status

Microsoft's exploitability assessment marks the bug as not exploited and not publicly disclosed, rates it Exploitation Less Likely, and gives exploit code maturity as Unproven. CISA ADP enrichment in the CVE record lists Exploitation as none, Automatable as no, and Technical Impact as total.

The reviewed advisory and CNA record do not identify any of the following:

• a threat actor, campaign, or victim
• exploit code or a proof of concept
• malicious document hashes or command and control infrastructure
• detection signatures

The advisory acknowledges an anonymous reporter. These are assessments made at publication time, and they do not guarantee that exploitation will not occur.

Patch information

Microsoft fixed this CVE in its November 10, 2026 Patch Tuesday release. The MSRC Security Update Guide API marks all nine affected product and architecture entries as "productStatus":"fixed". The advisory also sets customerActionRequired: true, so systems are only protected once the updated build is installed.

Fixed builds from the MSRC affected product data

• Microsoft Office LTSC 2021 (32-bit and 64-bit): 16.0.14334.21048
• Microsoft Office LTSC 2024 (32-bit and 64-bit): 16.0.17932.21140
• Microsoft 365 Apps for Enterprise (32-bit and 64-bit): the November 2026 Office security release. MSRC links to the Office security release notes rather than giving a single build number.
• Microsoft Office 365 for Mac: 16.115.26110837
• Microsoft Office LTSC for Mac 2021: 16.115.26110837
• Microsoft Office LTSC for Mac 2024: 16.115.26110837

Channel builds that include the fix

Microsoft's Release notes for Microsoft Office security updates page lists this CVE under Word in the November 10, 2026 entry, with these builds:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office 2024 Retail and Office 2021 Retail: Version 2610 (Build 20527.20196)
• Office LTSC 2024 Volume Licensed: Version 2408 (Build 17932.21140)
• Office LTSC 2021 Volume Licensed: Version 2108 (Build 14334.21048)

Use the build for your own product and channel. Builds from different channels are not interchangeable.

How the fix is delivered

There is no separate patch file for this CVE. The fix ships inside the cumulative monthly Office build for each servicing channel, so moving to the listed build or any later one includes it. Click to Run Office on Windows picks it up through the normal Office update channel. Mac installations receive it with the 16.115.26110837 release. To confirm whether a machine is patched, compare its installed Office build number with the lists above.

Microsoft's documented update paths are:

• Windows:
  1. Open Word and create a document.
  2. Select File > Account > Update Options > Update Now. Select Enable Updates first if it appears.
  3. If Update Options is missing and only About appears, the installation may be volume licensed or managed through Group Policy. Microsoft's documented next steps are Microsoft Update or your company help desk.
• Mac, installed from Microsoft: Open Word and select Help > Check for Updates, then Update in Microsoft AutoUpdate. AutoUpdate can also keep Microsoft apps updated automatically, and it shows application versions and installation dates next to the Update button.
• Mac, installed from the Mac App Store: Use App Store > Updates, then Update All or the individual application's Update button.

The advisory documents no workaround. Nothing in it establishes that disabling macros, changing Preview Pane settings, applying an attack surface reduction rule, or deploying a network signature remediates this CVE. The supported remediation is the vendor update.

Affected systems and versions

The CNA record lists these ranges. The upper boundary is exclusive, meaning that build is the first one outside the vulnerable range.

• Microsoft 365 Apps for Enterprise (32-bit and x64): affected from 16.0.1. The upper boundary is channel specific, so use the Office security release listing above.
• Microsoft Office LTSC 2021 (32-bit and x64): affected from 16.0.1, up to but not including 16.0.14334.21048.
• Microsoft Office LTSC 2024 (32-bit and x64): affected from 16.0.0, up to but not including 16.0.17932.21140.
• Microsoft Office 365 for Mac: affected from 1.0.0, up to but not including 16.115.26110837.
• Microsoft Office LTSC for Mac 2021: affected from 16.0.1, up to but not including 16.115.26110837.
• Microsoft Office LTSC for Mac 2024: affected from 16.0.0, up to but not including 16.115.26110837.

The documented vulnerable configuration is any of these installations in which a user opens an attacker-supplied crafted file in Word. The Preview Pane is excluded.

Vendor security history

The briefing does not reference prior Word CVEs. It does point to two documents about Microsoft's broader security track record.

The 2023 Exchange Online intrusion. The Cyber Safety Review Board concluded that the summer 2023 Exchange Online intrusion was preventable and should not have occurred. It attributed the intrusion to Storm-0558, a group associated with the government of the People's Republic of China, and described a cascade of Microsoft security failures. The Board also found Microsoft's security culture inadequate and in need of an overhaul. That case involves a different product and a different disclosure, and nothing in the reviewed material connects Storm-0558 to this Word vulnerability.

The Secure Future Initiative. Microsoft's July 2026 Secure Future Initiative progress report describes changes across culture, governance, and engineering. Of its objectives:

• three reached their target state
• three were nearing completion
• twelve had made significant progress

The report also cites 93% of critical and high-value build pipelines using centrally governed templates. It says over 81% of services emit critical security logs in a standard format. These are Microsoft's own figures, not an independent audit of Word, and they do not show that memory safety defects have been eliminated.

For developers, MITRE's general prevention guidance for these weakness classes is bounds checking (CWE-122) and avoiding unsafe conversion from larger to smaller primitive types (CWE-197). That guidance does not replace updating an installed copy of Word.

References

• NVD entry for CVE-2026-112726
• Official CVE record (CVE Services API)
• Microsoft Security Update Guide advisory
• MSRC Security Update Guide API: vulnerability record
• MSRC Security Update Guide API: affected products
• Microsoft Learn: Release notes for Microsoft 365 Apps security updates
• Microsoft Office security release listing
• Microsoft Support: How to update Microsoft 365 or Office for Windows
• Microsoft Support: Update Office for Mac automatically
• MITRE CWE-122: Heap based Buffer Overflow
• MITRE CWE-197: Numeric Truncation Error
• Cyber Safety Review Board: Review of the Summer 2023 Microsoft Exchange Online Intrusion
• European Commission: Commitments offered by Microsoft related to Teams
• Microsoft Security Blog: July 2026 Secure Future Initiative progress report
• Microsoft Trust Center: SFI Progress Report July 2026
• Zero Day Initiative: The November 2026 Security Update Review
• BleepingComputer: Microsoft November 2026 Patch Tuesday coverage