Introduction
Word documents move constantly between organizations, and a flaw that turns opening one into code execution under the user's account deserves careful attention from anyone managing Office fleets. CVE-2026-112733, patched by Microsoft on November 10, 2026, is exactly that kind of bug. It spans Microsoft 365 Apps, Office LTSC on Windows and Office for Mac, so the real work for defenders is matching each device to the correct fixed build for its edition and update channel.
The headline numbers are a CVSS 3.1 base score of 8.8 (High) from NVD and a Microsoft severity of Important. Exploitation is not automatic. Microsoft's scenario requires the victim to open a crafted document and use Word's Font Substitution control, and the Preview Pane is explicitly not an attack vector.
Technical information
Root cause
NVD classifies the issue as CWE 122, Heap Based Buffer Overflow, describing it as a heap buffer overflow in Microsoft Office Word that allows an unauthorized attacker to execute code over a network. MITRE defines this weakness as writing beyond the end of a buffer allocated on the heap, with typical consequences including crashes, memory corruption that affects control flow, and arbitrary code execution.
Microsoft's FAQ ties the bug to a specific feature. Font substitution is the step where Word swaps a font the document asks for, but which the system does not have, for one that it does have. In that code path, data taken from the document was used to write into a heap buffer without the size checks it needed. Because the attacker controls the document, the attacker influences the data driving that write.
Office is closed source, so Microsoft has not published a diff, commit or technical root-cause write-up. Closing this class of bug normally means validating lengths and counts read from the file against the real size of the allocated buffer before copying, but Microsoft has not said exactly how it changed the code. The public record also does not identify the vulnerable function, the allocation error, the overwrite size, or the document structure involved.
Attack flow
Based on Microsoft's documented scenario, exploitation proceeds as follows:
- The attacker prepares a specially crafted Word document whose contents reach the font substitution code path.
- The attacker delivers the document to the target. No account on the target system is required, and CVSS classifies the attack vector as Network.
- The victim opens the document in Word. Previewing it is not enough. MSRC states the Preview Pane is not an attack vector, so the vulnerable code runs only once the document is open.
- The victim uses the Font Substitution control.
- Document-supplied data is written past the bounds of a heap buffer. If exploitation succeeds, the attacker's code runs with the permissions of the logged-in user. The advisory does not describe automatic elevation to administrator or SYSTEM.
For risk modeling, describing the bug as a compromise triggered just by receiving or previewing a file would overstate what Microsoft disclosed.
Scoring
The published base vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
In plain terms: network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, and high impact to confidentiality, integrity and availability. MSRC also publishes a 7.7 temporal score. Its temporal vector includes RL:O (Remediation Level: Official Fix), meaning Microsoft considers this a complete vendor fix rather than a workaround or hotfix, and it rates exploit code maturity as Unproven.
Exploitation status at release
MSRC lists the CVE as "Publicly disclosed: No", "Exploited: No", and "Exploitation Less Likely", and states that public exploit code is unavailable or the exploit is theoretical. The Zero Day Initiative November 2026 review lists it as an Important Word remote code execution bug scored 8.8, without campaign or actor details. The CISA Known Exploited Vulnerabilities feed snapshot we reviewed, timestamped November 10, 2026 at 19:03:29.8375 UTC, had no entry for it. No threat actor, indicators or detection signatures have been published. These are point-in-time statements, not guarantees about future activity.
Patch information
Microsoft fixed CVE-2026-112733 in its November 10, 2026 Patch Tuesday release, and the Office security release notes for that date list the CVE under the Word component. Microsoft provides no vulnerability-specific workaround, so the update is the remediation.
Microsoft 365 Apps for Enterprise (32 bit and 64 bit)
MSRC points to aka.ms/OfficeSecurityReleases, which lists the November 10 builds for each channel:
- Current Channel: Version 2610 (Build 20527.20196)
- Monthly Enterprise Channel: 2610 (20527.20194), 2609 (20430.20264), 2608 (20326.20320)
- Semi Annual Enterprise Channel: 2610 (20527.20192), 2609 (20430.20262), 2608 (20326.20318)
- Office 2024 Retail and Office 2021 Retail: Version 2610 (Build 20527.20196)
Volume-licensed perpetual editions (32 bit and 64 bit)
- Office LTSC 2024: Version 2408, build 16.0.17932.21140. October's build 17932.21056 is still vulnerable.
- Office LTSC 2021: Version 2108, build 16.0.14334.21048. October's build 14334.20974 is still vulnerable.
macOS
Microsoft Office 365 for Mac, Office LTSC for Mac 2021 and Office LTSC for Mac 2024 are fixed in 16.115.26110837.
The November release notes also include an Office 2019 Volume Licensed build (1808, Build 10417.20236). The MSRC advisory does not list Office 2019 as affected by this CVE, so that build should not be counted as part of this fix.
Delivery and verification
Office uses Click to Run, so there is no separate KB to install for Word alone. The fix arrives in the monthly cumulative Office build for each update channel. On Windows, Microsoft documents triggering an update from an Office app via File > Account > Update Options > Update Now. On Mac, Microsoft AutoUpdate is reachable via Help > Check for Updates.
To confirm installation, check the build number under File > Account > About Word on Windows or Word > About Word on Mac and compare it with the lists above. A device counts as patched only if it is on the November build for its own channel or later. For example, a Semi Annual Enterprise Channel device on 2608 needs 20326.20318, not the Current Channel build number. Disabling or changing the Preview Pane is not a mitigation, since it is not an attack vector in the first place.
Affected systems and versions
Per the CVE record and NVD CNA data:
- Microsoft 365 Apps for Enterprise (32 bit and 64 bit): affected starting at 16.0.1. The record points to Office security releases rather than a single numeric upper bound, so use the per-channel builds listed above.
- Office LTSC 2021 (32 bit and 64 bit): from 16.0.1, before 16.0.14334.21048.
- Office LTSC 2024 (32 bit and 64 bit): from 16.0.0, before 16.0.17932.21140.
- Microsoft Office 365 for Mac: from 1.0.0, before 16.115.26110837.
- Office LTSC for Mac 2021: from 16.0.1, before 16.115.26110837.
- Office LTSC for Mac 2024: from 16.0.0, before 16.115.26110837.
The vulnerable configuration is any of these editions below the fixed build where a user opens an attacker-supplied document in Word and uses the Font Substitution control.
Vendor security history
The Cyber Safety Review Board's March 20, 2024 report on the Summer 2023 Exchange Online intrusion concluded that the intrusion was preventable and that Microsoft's security culture was inadequate and required an overhaul. The Board cited a cascade of avoidable errors, detection failures, and slow correction of inaccurate public statements, and recommended a public reform plan with specific timelines. That case concerns cloud identity and Exchange Online, not this Word bug.
Microsoft's July 2026 Secure Future Initiative report describes its response: three objectives at target state, three nearing completion and twelve making significant progress, along with reported outcomes such as decommissioning 1.4M unused Entra applications and remediating more than 550,000 instances of critical- and high-risk open-source vulnerabilities. These are Microsoft's own figures and say nothing about whether a given endpoint has the November Word fix installed.
References
- NVD entry for CVE-2026-112733
- CVE Record for CVE-2026-112733
- MSRC Security Update Guide: Microsoft Office Word Remote Code Execution Vulnerability
- Release notes for Microsoft Office security updates
- Release notes for Office for Mac
- Keep Office apps up to date with the latest updates
- MITRE CWE 122: Heap Based Buffer Overflow
- Zero Day Initiative: The November 2026 Security Update Review
- BleepingComputer: Microsoft November 2026 Patch Tuesday coverage
- CISA Known Exploited Vulnerabilities catalog (JSON feed)
- CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion (PDF)
- CISA: CSRB Report on Summer 2023 Microsoft Online Exchange Incident
- DHS: Cyber Safety Review Board Releases Report on Microsoft Online Exchange Incident
- Microsoft SFI Progress Report, July 2026
- Microsoft 2026 Annual Report
