Overview of CVE-2026-112729: Heap-Based Buffer Overflow in Microsoft Word Enables Code Execution via Crafted Documents

Introduction

Microsoft's November 10, 2026 security release closed a heap-based buffer overflow in Word that can give an attacker code execution on a workstation when a user opens a specially crafted document. Word runs on Windows and Mac endpoints throughout most enterprises, and the fix ships through several distinct update channels. For defenders, the practical work is confirming that the correct build reached every installation.

The key facts at a glance:

• CVSS 3.1 base score: 8.8 (High), temporal score 7.7 with an Official Fix available
• Microsoft severity: Important (not Critical)
• Weakness: CWE-122, heap-based buffer overflow
• Prerequisite: a user must open an attacker-supplied file. The Preview Pane is not an attack vector.
• Exploitation at publication: Exploited: No, Publicly disclosed: No, Exploitation Less Likely

Technical information

Root cause

Microsoft's advisory states that a heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network, and classifies the weakness as CWE-122. MITRE defines CWE-122 as a buffer overflow in which the overwritten buffer was allocated in the heap portion of memory. Its generic examples describe input that exceeds the size of the allocated buffer.

That is the extent of the public root-cause information. Word is closed source, and Microsoft has not published a diff, commit, or root-cause write-up. The reviewed advisory and canonical CVE records do not identify the vulnerable function, the document format or record type involved, the heap layout, a payload, or an exploit chain. NVD currently lists the record as Awaiting Analysis, with Microsoft as the source of the CVSS assessment.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

When you communicate the risk internally, remember that AV:N combined with UI:R describes a malicious document that a user has to open. It does not describe an interaction-free network attack against a listening service.

Attack flow

Based on Microsoft's description, the documented sequence is short:

1. The attacker prepares a specially crafted file that triggers the heap overflow when Word processes it.
2. The attacker delivers the file to a target. Microsoft does not specify a delivery channel or file extension.
3. The user opens the file in Word. Rendering in the Preview Pane is explicitly not an attack vector.
4. Word's processing of the file overflows a heap buffer, which can lead to remote code execution.

Anything more specific than this, such as which parser is reached or how the corruption is turned into control of execution, is not supported by the available sources.

Exploitation status

At original publication, the MSRC advisory recorded Exploited: No, Publicly disclosed: No, Exploitation Less Likely, and exploit code maturity Unproven. Microsoft explains Unproven as publicly available exploit code being unavailable or exploitation remaining theoretical.

CISA's Coordinator SSVC entry, timestamped November 10, 2026 at 20:31:21 UTC, is consistent with that picture:

"Technical impact: total" describes possible consequences, while "Exploitation: none" describes observed activity, so the two do not conflict. The reviewed records identify no threat actor, malware family, campaign, sample hashes, or network indicators for this CVE. These are publication-day assessments and do not prove exploitation cannot occur later.

A note on conflicting upstream data: one upstream summary described CVE-2026-112729 as an actively exploited Outlook spoofing zero day used to steal NTLM hashes. That is incorrect. BleepingComputer's November 2026 Patch Tuesday coverage attributes that zero day to CVE-2026-124194 (Microsoft Outlook Spoofing Vulnerability) and lists CVE-2026-112729 separately as a Word remote code execution bug rated Important.

Patch information

Microsoft fixed CVE-2026-112729 in its November 10, 2026 Patch Tuesday release, and revision 1.0 of the advisory was published the same day. The advisory sets the CVSS temporal Remediation Level to Official Fix, which CVSS defines as "A complete vendor solution is available." That lowers the temporal score from the 8.8 base to 7.7.

Because the fix ships inside Office binaries, you verify it by build number. Microsoft lists the following fixed builds:

For Microsoft 365 Apps, the November 10 security release notes include these entries. They are per-channel targets, not interchangeable builds:

The LTSC entries in the release notes independently match the boundaries in the CNA record.

Delivery paths

• Microsoft 365 Apps and Office LTSC on Windows: delivered through Click to Run. The KB links point to the Microsoft 365 Apps security updates release notes. Check your channel's build against the Office security release list. To update manually, open Word, create a document, and select File > Account > Update Options > Update Now (select Enable Updates first if Update Now is unavailable). If only About appears and Update Options is missing, the installation likely uses a volume license or is managed by Group Policy. In that case, updates come through Microsoft Update or your organization's management tooling.
• Office for Mac: fixed in build 16.115.26110837, documented in the Release notes for Office for Mac and delivered by Microsoft AutoUpdate. Open Word or Excel, select Help > Check for Updates, choose Update or Update All, then restart the application.

No documented workaround

The advisory provides no CVE-specific workaround. Macro blocking, file extension filtering, and Preview Pane changes are not established as substitutes for the update. The Preview Pane in particular is explicitly not an attack vector.

What the fix probably changes

Microsoft has not said which parser or record type was at fault. Fixes for this bug class usually do one or more of the following, but none of them is confirmed for CVE-2026-112729:

• Validate length or count fields read from the document against the size of the destination heap buffer before copying.
• Guard allocation size calculations against integer overflow.
• Reject malformed structures instead of processing them.

Treat this as background on CWE-122, not a description of Microsoft's actual change.

Affected systems and versions

The Microsoft CNA record lists six product families. Each upper boundary is exclusive: versions below it are affected. Windows products are listed for both 32-bit and x64 systems.

The Mac boundaries come from the CVE record rather than from a separately identified Mac release note entry for this CVE.

Vendor security history

Microsoft is both the affected vendor and the assigning CNA. The most significant independent assessment of its security practices is the Cyber Safety Review Board's review of the summer 2023 Exchange Online intrusion by Storm-0558, an actor assessed as affiliated with the People's Republic of China. The Board found the intrusion preventable and identified operational and strategic decisions that collectively pointed to a corporate culture that deprioritized enterprise security investment and rigorous risk management. It recommended that Microsoft publish a plan with specific timelines for fundamental security reforms.

Microsoft publicly accepted responsibility and described its Secure Future Initiative, built on Secure by Design, Secure by Default, and Secure Operations, as a multiyear change to how it designs, builds, tests, and operates products. Its July 2026 progress report states that it decommissioned 1.4 million unused Entra applications, removed public access from 732,000 resources, and moved 93% of critical and high-value build pipelines to centrally governed templates. Microsoft reported these figures itself. They are not independent findings.

None of this history is technically connected to CVE-2026-112729. Storm-0558 concerned a cloud email intrusion, and nothing in the reviewed records links that actor to this Word bug.

References

• NVD: CVE-2026-112729
• CVE.org record: CVE-2026-112729
• MSRC Security Update Guide: CVE-2026-112729, Microsoft Office Word Remote Code Execution Vulnerability
• CVE Services API record (CNA data)
• NVD API record
• MSRC CVRF: November 2026
• Release notes for Microsoft Office security updates
• Release notes for Office for Mac
• How to update Microsoft 365 or Office for Windows
• Update Microsoft 365 or Office on macOS or iOS
• MITRE CWE-122: Heap Based Buffer Overflow
• BleepingComputer: Microsoft November 2026 Patch Tuesday coverage
• Microsoft 2026 Annual Report
• DHS: Cyber Safety Review Board report on the Summer 2023 Microsoft Exchange Online incident
• Microsoft On the Issues: Microsoft's work to strengthen cybersecurity protection
• Microsoft Trust Center: SFI Progress Report July 2026