Introduction
Microsoft's November 10, 2026 Patch Tuesday release fixed a heap-based buffer overflow in Microsoft Office Word. The flaw gives an attacker a path to code execution when a user opens a specially crafted document. The affected products span Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021 and 2024 on both Windows and Mac. Remediation therefore has to cover two platforms and several servicing models rather than a single version threshold.
Microsoft rates the issue CVSS 3.1 8.8 (High), with a product severity classification of Important. Below we summarize what the public record establishes, what it leaves out, and how to confirm that each installation is patched.
Technical information
Root cause
The vulnerability is classified as CWE 122, Heap based Buffer Overflow. MITRE defines this weakness as writing beyond the end of a buffer allocated on the heap. The case-specific description says the flaw "allows an unauthorized attacker to execute code over a network."
Office is closed source, so there is no public commit, diff, or code snippet to examine. Microsoft has not disclosed:
- the vulnerable function or the document format involved
- allocation sizes or the overwrite target
- exploit reliability or a working exploit
- whether macros play any role
- the privilege level an attacker would obtain after exploitation
We have not filled those gaps with details borrowed from other Word bugs.
CVSS conditions
The published base vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required. Microsoft's FAQ specifies that the user must open the crafted file.
- Scope: Unchanged. This is not a separate privilege escalation finding.
- Confidentiality, Integrity, Availability: High
Network and User Interaction Required are separate conditions. The record does not support calling this an unattended network service exploit. Equally, the interaction requirement does not reduce the potential impact. The score describes what a successful attack could do. It is not evidence that data theft, modification, or disruption has occurred.
Microsoft also publishes the temporal vector E:U/RL:O/RC:C, which brings the score down to 7.7:
- Exploit code maturity is Unproven.
- Remediation level is Official Fix.
- Report confidence is Confirmed.
NVD records an exploitability subscore of 2.8 and an impact subscore of 5.9.
Attack flow
The steps below follow Microsoft's documented scenario.
- The attacker prepares a specially crafted file designed to trigger the heap overflow in Word.
- The attacker gets the file to the target user. The advisory does not specify a delivery channel.
- The user opens the file in Word. Microsoft states that the Preview Pane is not an attack vector, so previewing alone is not the documented trigger.
- While Word processes the file, data is written beyond the bounds of a heap allocation. This follows from the CWE 122 classification. Microsoft has not described the internal corruption sequence.
- Successful exploitation results in code execution, with High confidentiality, integrity, and availability impact under the CVSS assessment.
Exploitability status at publication
These signals come from official assessments and are point-in-time judgments.
- Publicly disclosed: No. This is Microsoft's original publication assessment.
- Exploited: No, per Microsoft.
- Exploitability assessment: Exploitation Less Likely. This is a likelihood judgment, not a statement that exploitation is impossible.
- CISA SSVC (recorded in NVD at 2026-11-10T20:31:09.974799Z): exploitation none, automatable no, technical impact total.
Neither the Microsoft advisory nor the NVD record identifies a threat actor, campaign, malicious document hashes, or infrastructure. High technical severity and low reported activity are not contradictory, because CVSS, Microsoft's exploitability index, and SSVC each measure something different.
Record details
- Published: 2026-11-10T19:18:32.070
- Last modified: 2026-11-10T21:18:28.400
- Source: [email protected]
- NVD status: Awaiting Analysis
The 8.8 score comes from Microsoft. NVD had not added a separate NIST score in the examined record.
Patch information
Microsoft fixed CVE-2026-112730 in its November 10, 2026 Patch Tuesday release. The MSRC advisory is at revision 1.0, published that day, with no later changes. The RL:O (Official Fix) component means Microsoft has shipped a complete vendor solution, not a workaround or hotfix.
The fix ships with the normal Office servicing updates, not as a separate package. A system is protected once Office reaches or passes the following builds. Anything lower is vulnerable.
- Microsoft Office 365 for Mac: 16.115.26110837
- Microsoft Office LTSC for Mac 2021: 16.115.26110837
- Microsoft Office LTSC for Mac 2024: 16.115.26110837
- Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048
- Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140
- Microsoft 365 Apps for Enterprise (32 bit and 64 bit): depends on the update channel; see Office Security Releases
Microsoft 365 Apps has no single fixed build. Each update channel (Current, Monthly Enterprise, Semi Annual) receives its own build, and the fixed version for each is listed in Microsoft's Office security release notes. Microsoft's November 10 release table independently lists the LTSC builds 14334.21048 and 17932.21140.
Where the updates come from
- Windows (Microsoft 365 Apps and Office LTSC): delivered through Click to Run. See the Office security update release notes.
- In an Office app, go to File > Account > Update Options > Update Now. If Update Now is unavailable, select Enable Updates first.
- If only About appears, the installation may use volume licensing or Group Policy managed updates. Microsoft's guidance is to try Microsoft Update or contact the help desk. A missing update option does not mean the installation is patched.
- Mac: normally delivered through Microsoft AutoUpdate. See the Office for Mac release notes.
- In Word, select Help > Check for Updates, enable Automatically keep Microsoft apps up to date, and select Update.
- For App Store installs, use App Store Updates.
- Administrators can also deploy update packages through existing software deployment tools.
What the fix probably changes
Microsoft has not published root cause details. The CWE 122 classification and the crafted file prerequisite suggest the fix adds missing bounds or size checks in Word's document parsing code, so that a malformed field can no longer write past the end of a heap buffer. That is an inference from the bug class, not something Microsoft has stated.
The update also arrived in a very large Office release. ZDI's November 2026 review counts 65 Word CVEs in this cycle, most of them remote code execution bugs. Patching to the builds above should address many Word memory corruption issues at once.
The advisory specifies no separate workaround, registry change, firewall rule, or CVE-specific hardening. It does not validate disabling macros or any other configuration change as a replacement for the official update.
Verifying the build
- Windows: open any Office app and go to File > Account > About.
- Mac: in Word, go to Word > About Word.
Compare the build number with the list above. For Microsoft 365 Apps, compare it with the fixed build for your update channel.
Affected systems and versions
The affected ranges below come from the CNA data, which NVD mirrors.
- Microsoft 365 Apps for Enterprise (32 bit and 64 bit): from 16.0.1. The upper bound is an Office security release reference, not a single numeric build.
- Microsoft Office 365 for Mac: from 1.0.0, up to but not including 16.115.26110837.
- Microsoft Office LTSC 2021 for Windows (32 bit and 64 bit): from 16.0.1, up to but not including 16.0.14334.21048.
- Microsoft Office LTSC 2024 for Windows (32 bit and 64 bit): from 16.0.0, up to but not including 16.0.17932.21140.
- Microsoft Office LTSC for Mac 2021: from 16.0.1, up to but not including 16.115.26110837.
- Microsoft Office LTSC for Mac 2024: from 16.0.0, up to but not including 16.115.26110837.
The documented vulnerable condition is a user opening a crafted file in an affected Word build. Configurations that only render the file in the Preview Pane are not part of the documented attack path.
Vendor security history
Microsoft is both the vendor and the CNA here. For context on its market position, a European Commission decision dated September 12, 2025 described a preliminary assessment in which Microsoft "would be dominant" in the worldwide market for SaaS productivity applications for professional use, a market that includes Word. That was a commitment decision concerning Teams distribution, not a final infringement finding. It also does not measure how many systems are exposed to this CVE.
The most relevant track-record item is the Cyber Safety Review Board's review of the separate 2023 Exchange Online intrusion. In that incident, an actor the Board associated with the government of the People's Republic of China compromised Microsoft's cloud environment and accessed the email accounts of senior United States officials. The Board concluded the intrusion was preventable and identified several failures:
- an inadequate security culture
- Microsoft's failure to independently detect compromise of important cryptographic material
- the slow correction of inaccurate public statements about the incident
In its June 13, 2024 response, Microsoft described the Secure Future Initiative and its principles of Secure by Design, Secure by Default, and Secure Operations. It said it was:
- acting on 16 applicable recommendations
- adding 18 security objectives
- basing one third of each senior leader's individual performance bonus on cybersecurity performance
These are commitments, not independently demonstrated outcomes. None of this history indicates that the Exchange incident and this Word flaw share a cause or an exploiting actor.
References
- NVD: CVE-2026-112730
- CVE Record: CVE-2026-112730
- Microsoft Security Update Guide: CVE-2026-112730
- NVD API record for CVE-2026-112730
- Zero Day Initiative: The November 2026 Security Update Review
- BleepingComputer: Microsoft November 2026 Patch Tuesday coverage
- MITRE CWE 122: Heap based Buffer Overflow
- Release notes for Microsoft Office security updates
- Office Security Releases
- Release notes for Office for Mac
- How to update Microsoft 365 or Office for Windows
- Update Office for Mac automatically
- CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
- DHS: Cyber Safety Review Board releases report on Microsoft Online Exchange incident
- Microsoft On the Issues: Microsoft's work to strengthen cybersecurity protection
- European Commission decision summary, Cases AT.40721 and AT.40873
