Overview of CVE-2026-112728: Heap-Based Buffer Overflow in Microsoft Office Word Leading to Remote Code Execution

Introduction

Microsoft's November 10, 2026 security release fixes a heap-based buffer overflow in Word that can lead to code execution when a user opens a crafted document. The bug spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and several Office for Mac releases. Because Office ships as complete builds, confirming remediation means checking build numbers, not looking for a single patched file.

Technical information

Root cause

CVE-2026-112728 is classified as CWE-122: Heap Based Buffer Overflow. Microsoft describes it as a heap-based buffer overflow in Microsoft Office Word that allows an unauthorized attacker to execute code over a network. MITRE's description of the weakness class notes that heap corruption of this kind can cause crashes and can sometimes enable arbitrary code execution, for example by overwriting function pointers stored on the heap.

That is where the public detail ends. Microsoft has not disclosed:

• the file format involved
• the vulnerable parser or function
• the exact memory corruption primitive
• any payload or information on exploit reliability

Word is closed source, so there is no public commit or diff to study, and we have no vulnerable code to show. Anything more specific about the root cause would be speculation.

Scoring

Microsoft's CVSS 3.1 base vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Here is what each metric means for this bug:

• Attack Vector: Network.
• Attack Complexity: Low.
• Privileges Required: None. The attacker needs no prior access.
• User Interaction: Required. A user has to open the crafted file.
• Scope: Unchanged.
• Confidentiality, Integrity, Availability: High for each.

The base score of 8.8 (High) comes from Microsoft. NVD lists the record as Awaiting Enrichment and has not published its own assessment. Microsoft's advisory severity is Important. The two ratings come from different systems, so they do not conflict.

Attack flow

Based on Microsoft's advisory and FAQ, the documented sequence is:

1. The attacker prepares a specially crafted file that targets the Word memory corruption flaw.
2. The attacker supplies that file to a target user. The advisory does not specify a delivery mechanism.
3. The user opens the file in Word. Microsoft states that the Preview Pane is not an attack vector, so previewing alone is not the documented trigger.
4. Word processes the file, the heap-based overflow occurs, and the attacker can use it to start code execution.

The "Network" attack vector does not make this attack interaction free. Exposure depends on a user opening an attacker-supplied file.

Exploitation status

Microsoft's advisory recorded the following at original publication on November 10, 2026:

• Publicly disclosed: No
• Exploited: No
• Exploitability assessment: Exploitation Less Likely
• Exploit Code Maturity: Unproven

We did not find the identifier in the CISA Known Exploited Vulnerabilities catalog snapshot we retrieved (catalog version 2026.11.10). The reviewed sources do not link this CVE to any named threat actor, campaign, malware family, or validated public exploit. Microsoft credits Haein Lee with KAIST Hacking Lab and an Anonymous contributor in its acknowledgements. Those are researcher credits, not threat attribution.

The high CVSS score and the Exploitation Less Likely assessment answer different questions. The first describes technical impact and prerequisites. The second is Microsoft's view of how likely exploitation is. Neither one rules out future exploitation.

Patch information

Microsoft fixed CVE-2026-112728 in its November 10, 2026 security release. The fix is delivered only as new Office builds, and the evidence for it comes from Microsoft's own data.

Status in MSRC

• The Security Update Guide API marks every affected product entry as "productStatus":"fixed".
• The temporal vector is shown below. RL:O means Remediation Level: Official Fix, which lowers the temporal score from 8.8 to 7.7. The base score stays at 8.8.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• The advisory sets customerActionRequired: true. The fix protects a machine only after the updated build is installed.

First fixed builds by product

These values come from the MSRC affected product feed and match the NVD version ranges:

• Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140
• Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048
• Office LTSC for Mac 2024, Office LTSC for Mac 2021, Office 365 for Mac: 16.115.26110837
• Microsoft 365 Apps for Enterprise (x86/x64): builds per channel, listed under the November 10, 2026 entry in the Office security release notes

Microsoft 365 Apps, Retail, and Volume Licensed channels

Microsoft 365 Apps is serviced through several update channels, so MSRC points to the Office release notes instead of giving one build number. The November 10, 2026 release notes list CVE-2026-112728 in the Word section, which names these builds:

• Current Channel: Version 2610, Build 20527.20196
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office 2024 Retail and Office 2021 Retail: Version 2610, Build 20527.20196
• Office LTSC 2024 Volume Licensed: Version 2408, Build 17932.21140
• Office LTSC 2021 Volume Licensed: Version 2108, Build 14334.21048

The same Word section covers many other November Word CVEs, such as CVE-2026-112726 and CVE-2026-112729. A single build update moves Word past all of them, including this overflow.

Why the fix is build based

Click to Run Office ships a complete new build with each release rather than patching individual files. The MSRC entries list no individual affected binaries ("affectedBinaries":[]). The fix is therefore to move the whole Word build forward, and the build number is how you confirm it is in place.

Microsoft has not said what code changed. For a CWE-122 bug in a document parser, the usual fix is to validate length or count fields taken from the file before copying data into heap buffers. That is an educated guess, not something Microsoft has confirmed.

Verifying a machine

• Microsoft 365 Apps and LTSC builds use the format 16.0.<build>. A machine is fixed when its build number is equal to or higher than the build listed for its channel.
• Office for Mac is fixed at 16.115.26110837 or later. The MSRC records point Mac administrators to the Office for Mac release notes.

Microsoft documents no configuration workaround. Because the Preview Pane is not the attack vector, disabling it is not a vendor-documented mitigation.

Affected systems and versions

The CVE record gives the following ranges. In each case the upper boundary is excluded from the affected range, which means it is the first fixed version.

• Microsoft 365 Apps for Enterprise (32 bit and x64): from 16.0.1. The upper boundary is set by the Office security release guidance for each channel.
• Microsoft Office 365 for Mac: from 1.0.0 up to but not including 16.115.26110837
• Microsoft Office LTSC 2021 (32 bit and x64): from 16.0.1 up to but not including 16.0.14334.21048
• Microsoft Office LTSC 2024 (32 bit and x64): from 16.0.0 up to but not including 16.0.17932.21140
• Microsoft Office LTSC for Mac 2021: from 16.0.1 up to but not including 16.115.26110837
• Microsoft Office LTSC for Mac 2024: from 16.0.0 up to but not including 16.115.26110837

Knowing that an installation is Word is not enough. The Windows LTSC releases, the Mac releases, and the Microsoft 365 Apps channels each have their own fixed build, so you also need the product family.

Vendor security history

The Cyber Safety Review Board's review of the summer 2023 Microsoft Exchange Online intrusion is the most detailed independent assessment of Microsoft's recent security practices. The board describes how the threat actor combined possession of a Microsoft consumer signing key with the ability to access enterprise Exchange accounts. It also criticized Microsoft's delayed correction of inaccurate public statements about the root cause. The board found that a series of operational and strategic decisions reflected a culture that deprioritized enterprise security investment and rigorous risk management. It recommended direct CEO and board attention, a publicly shared reform plan with timelines, leadership accountability, and prioritizing security over feature development where necessary.

Microsoft's July 2026 Secure Future Initiative report describes changes to culture, governance, and engineering organized around Secure by Design, Secure by Default, and Secure in Operations. Microsoft reports remediating more than 550,000 critical and high-risk open-source vulnerability instances, and says automated container patching addresses about 3 million vulnerability instances each month. These figures are reported by Microsoft, not measured independently. The 2023 intrusion is not connected to this Word vulnerability, and neither source tells you whether a given Word installation is protected. Only the product-specific fixed builds above can answer that.

References

• NVD entry for CVE-2026-112728
• CVE Record for CVE-2026-112728
• Microsoft Security Update Guide: CVE-2026-112728
• MSRC Security Update Guide API: vulnerability entry
• MSRC Security Update Guide API: affected products
• MSRC CVRF document for November 2026
• Release notes for Microsoft Office security updates (aka.ms)
• Release notes for Microsoft Office security updates (Microsoft Learn)
• MITRE CWE-122: Heap Based Buffer Overflow
• CISA Known Exploited Vulnerabilities Catalog
• CISA Known Exploited Vulnerabilities JSON feed
• Cyber Safety Review Board: Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft Secure Future Initiative Progress Report, July 2026
• Microsoft 2026 Annual Report