Quick Look: Microsoft Word CVE-2026-112735 Use After Free Leading to Remote Code Execution

Introduction

Microsoft's November 10, 2026 Office security release closes a memory safety flaw in Word that can give an attacker code execution with the permissions of the user who works with a crafted document. The bug carries a CVSS 3.1 base score of 8.8 and spans Microsoft 365 Apps, Office LTSC 2021 and 2024 on Windows, and several Office editions for Mac, so remediation touches multiple servicing channels and two operating system families.

The trigger for CVE-2026-112735 is more interesting than its score. Microsoft's advisory describes a specific template and Quick Parts workflow, rules out the Preview Pane, and records no exploitation at publication. Below we summarize what the sources establish and what they leave open.

Technical information

Root cause

Microsoft describes the issue as: "Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network." The assigned weakness is CWE-416, Use After Free.

MITRE defines this weakness as software referencing memory after it has been freed. Once freed, that memory can be reallocated to a different object while an original pointer still refers to it, so any operation through the stale pointer acts on memory that now belongs to something else. Depending on how the reallocation is shaped, outcomes range from crashes and data corruption to information disclosure and arbitrary code execution. For this CVE, Microsoft's description confirms the code execution outcome.

Word is closed source. There is no public commit, diff, or technical write-up of the code change, and Microsoft has not published the vulnerable function, the object layout, or the precise memory corruption primitive. The fix ships as rebuilt Office binaries.

What the advisory reveals about the trigger

Microsoft's FAQ is considerably more specific than the NVD description:

"An attacker could provide a specially crafted document and convince a user to load and unload it as a Word template, then select an affected item from the Quick Parts gallery."

That sequence maps cleanly onto a classic object lifetime bug. Our reading, which is an inference from the trigger and not a statement from Microsoft, is that unloading the template frees memory backing a Quick Parts gallery entry while the gallery still holds a dangling reference to it. Selecting the entry afterward makes Word dereference freed memory, which an attacker can attempt to groom into code execution as the user.

Attack flow

Based on the advisory, exploitation proceeds as follows:

1. The attacker prepares a specially crafted document and delivers it to the target.
2. The attacker convinces the user to load that document as a Word template.
3. The user unloads the template, which (per our inference above) releases memory still referenced by the Quick Parts gallery.
4. The user selects an affected item from the Quick Parts gallery.
5. Word operates on the freed memory, and successful exploitation executes attacker code with the user's permissions.

A few constraints matter for triage:

• The attacker does not need an account on the affected system.
• The Preview Pane is explicitly not an attack vector. Receiving the document does not compromise the system on its own, and Preview Pane claims made about other Office bugs should not be carried over to this one.
• Code runs in the user's context, so impact is bounded by that user's privileges.

CVSS assessment

NVD displays Microsoft's assessment rather than an independent NIST score. The base vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

That yields 8.8 (High): network attack vector, low complexity, no privileges, user interaction required, unchanged scope, and high confidentiality, integrity, and availability impact. The AV:N rating should be read together with UI:R and the FAQ, because the described attack still depends on the template load, unload, and Quick Parts selection.

Microsoft also publishes a temporal score of 7.7 with the extended vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

E:U reflects unproven exploit code maturity, RL:O reflects an official fix, and RC:C reflects confirmed report confidence. The temporal score does not replace the 8.8 base score.

Exploitation status

At original publication, Microsoft's advisory data records:

• Exploited: No
• Publicly disclosed: No
• Exploitability assessment: Exploitation Less Likely

CISA's enrichment in the CVE record lists exploitation as none. The reviewed sources name no threat actor and provide no malicious document hashes, infrastructure, campaign names, or public exploit code. The Zero Day Initiative's November 2026 review independently lists this CVE as a Word remote code execution bug with a CVSS of 8.8 and Microsoft severity Important. An 8.8 base score and an Exploitation Less Likely rating answer different questions, so they do not contradict each other, and both belong in operational reporting.

Patch information

Microsoft fixed CVE-2026-112735 in its November 10, 2026 (Patch Tuesday) Office security release. The CSAF advisory lists every remediation entry as a vendor_fix, and the temporal vector includes RL:O (Official Fix). The fix is the only remediation Microsoft offers. The advisory lists no workaround and no mitigating factor, and its Customer Action note says customers must act to resolve the issue. Nothing in the advisory establishes that disabling macros, registry changes, extension blocking, or disabling the Preview Pane prevents exploitation.

Fixed builds by product

From Microsoft's CSAF product_tree and remediations:

• Office LTSC 2021 (32 bit and 64 bit): vulnerable below 16.0.14334.21048; fixed in 16.0.14334.21048 (Version 2108)
• Office LTSC 2024 (32 bit and 64 bit): vulnerable below 16.0.17932.21140; fixed in 16.0.17932.21140 (Version 2408)
• Office LTSC for Mac 2021, Office LTSC for Mac 2024, Office 365 for Mac: vulnerable below 16.115.26110837; fixed in 16.115.26110837
• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): vulnerable on builds earlier than the November 2026 channel builds; fixed build depends on the channel (below)

Microsoft 365 Apps channel builds

The CSAF entry for Microsoft 365 Apps gives no version number and instead points to Microsoft's Office security releases page, because the fixed build depends on the update channel. Microsoft's release notes for Office security updates list CVE-2026-112735 under Word in the November 10, 2026 section, with these builds:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel (receives Monthly Enterprise Channel builds): Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office 2024 Retail and Office 2021 Retail: Version 2610 (Build 20527.20196)

These builds are channel specific. Do not substitute a build from a different servicing path.

Two caveats. The Mac remediation entry points to Microsoft's Office for Mac release notes, which were not checked for this write-up, so the 16.115.26110837 build comes from the CSAF advisory alone. And while the same release notes page lists an Office 2019 Volume Licensed build (10417.20236), Office 2019 is not among the affected products for this CVE, so that build is not evidence of a fix here.

Delivery and verification

Office uses Click to Run, so there is no separate per-CVE KB. The fix ships in the cumulative monthly Office build for each channel, alongside other Word fixes released the same day. Any build at or above the numbers listed includes the fix.

• Windows verification: compare the version and build under File > Account > About Word against the lists above.
• Managed Windows fleets: Microsoft's Intune guidance documents enabling Microsoft 365 Apps Automatic Updates, configuring Update Channel, and assigning the policy to Windows client devices. It also documents a Target Version setting and recommends trialing it with a test policy assigned to a test group. These capabilities require Intune and a Microsoft 365 subscription.
• Mac with Microsoft AutoUpdate: open an Office app such as Word, choose Help > Check for Updates, then Update. The Automatically keep Microsoft apps up to date option keeps future security fixes flowing.
• Mac App Store installs: use App Store > Updates, then Update All or the relevant app's Update button. Confirm the result against 16.115.26110837.

How fixes for this bug class typically work

Microsoft has not described the code change. As general background only, not a description of this patch, use-after-free bugs of this shape are usually fixed by invalidating or removing cached entries when their owning container (here, the template) unloads, by reference counting shared objects so they outlive every consumer, or by revalidating that an object still exists before dereferencing it.

Microsoft credits Kentaro Kawane of GMO Cybersecurity by Ierae, Inc. with reporting the vulnerability.

Affected systems and versions

The Microsoft-authored CVE record lists the following affected ranges. In each case the upper boundary is excluded, meaning that build and later are not affected. The Windows enterprise and LTSC entries cover both 32-bit and x64 platforms.

• Microsoft 365 Apps for Enterprise: starting at 16.0.1; upper boundary defined by the applicable Office security release for the servicing channel
• Microsoft Office 365 for Mac: 1.0.0 up to but not including 16.115.26110837
• Microsoft Office LTSC 2021: 16.0.1 up to but not including 16.0.14334.21048
• Microsoft Office LTSC 2024: 16.0.0 up to but not including 16.0.17932.21140
• Microsoft Office LTSC for Mac 2021: 16.0.1 up to but not including 16.115.26110837
• Microsoft Office LTSC for Mac 2024: 16.0.0 up to but not including 16.115.26110837

The only documented vulnerable configuration is the template load, unload, and Quick Parts selection workflow. Office 2019 is not listed as affected.

Vendor security history

The most concrete independent assessment of Microsoft's security record in the briefing is the Cyber Safety Review Board's review of the 2023 Exchange Online intrusion. The Board described a People's Republic of China affiliated actor pursuing espionage who accessed mailboxes at 22 organizations and over 500 individuals using authentication tokens signed with a Microsoft key created in 2016. It concluded the intrusion was preventable and that Microsoft's security culture was inadequate and required an overhaul.

In a June 13, 2024 response, Microsoft accepted responsibility and committed to acting on all 16 recommendations applicable to it. The response described the Secure Future Initiative, an Office of the CISO with senior Deputy CISOs, and tying one third of senior leadership individual bonuses exclusively to cybersecurity performance. Microsoft's July 2026 SFI progress report states that three objectives reached their target state, three were nearing completion, and twelve had made significant progress. These are vendor-reported figures.

None of this relates directly to CVE-2026-112735. The Exchange Online incident concerned cloud authentication, not Word memory safety, and it is not evidence that the actor involved exploits this bug. For this CVE, the actionable deliverables are the advisory, the version data, and the Office updates.

References

• NVD entry for CVE-2026-112735
• CVE record for CVE-2026-112735 (CVE Services API)
• NVD API record for CVE-2026-112735
• Microsoft Security Update Guide: CVE-2026-112735
• Microsoft CSAF advisory for CVE-2026-112735
• MSRC Security Update Guide API entry
• MSRC CVRF document, November 2026
• Release notes for Microsoft Office security updates
• Update Microsoft 365 Apps with the Settings Catalog in Intune
• Update Office for Mac automatically
• CWE 416: Use After Free (MITRE)
• Zero Day Initiative: The November 2026 Security Update Review
• Casco CVE entry for CVE-2026-112735
• CISA Known Exploited Vulnerabilities Catalog
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft's work to strengthen cybersecurity protection
• SFI Progress Report July 2026
• Microsoft 2026 Annual Report