Introduction
A crafted Word document remains one of the most dependable ways to get code running on a corporate endpoint, and Microsoft's November 10, 2026 Patch Tuesday release closes another path of exactly that kind. CVE-2026-112741 is a heap buffer overflow in Microsoft Office Word. Once a user opens a malicious file, it can give an unauthorized attacker code execution with high impact to confidentiality, integrity, and availability across Microsoft 365 Apps, Office LTSC on Windows, and several Mac editions.
The good news is that, at publication, Microsoft reported no exploitation and no public disclosure. The less comfortable news is that Word is everywhere, the fix ships inside regular Office builds rather than a single KB, and one product family (Microsoft 365 Apps) has no single fixed build number to check against. Below is a short review of what the sources establish.
Technical information
Root cause
Microsoft classifies the weakness as CWE-122, heap buffer overflow. MITRE defines CWE-122 as a product writing beyond the end of a buffer allocated on the heap. In a document parser, that typically means data taken from the file is copied into a heap allocation that is too small for it.
That is as far as the public record goes. The advisory and CVE record do not publish:
- the vulnerable Word parser, function, or document structure
- the allocation size calculation or corruption offset
- an exploit payload or reproducible proof of concept
The reviewed sources establish CWE-122 only. They do not establish the additional numeric truncation weakness that has been associated with some other Word vulnerabilities, so we would not assume one here. Because Office is closed source, there is no public commit or diff to inspect either.
CVSS breakdown
Microsoft, acting as CNA, publishes the following base vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Base score: 8.8 (High). NVD shows this score attributed to Microsoft. NVD's own assessment is still marked Awaiting Enrichment.
- Temporal score: 7.7, with Remediation Level Official Fix (RL:O) and exploit code maturity Unproven (no public exploit code, or an exploit that is only theoretical).
- Microsoft severity: Important, not Critical. Some secondary write-ups call this bug critical, but Microsoft's advisory and the Patch Tuesday CVE tables do not.
Metric by metric:
- AV:N (Network): the assessment classifies exploitation as remote.
- AC:L (Low): no specialized access conditions are required.
- PR:N (None): the attacker needs no prior authorization.
- UI:R (Required): a user must participate. Microsoft specifies opening the file.
- S:U (Unchanged): impact stays within the same security authority.
- C:H / I:H / A:H: high confidentiality, integrity, and availability impact.
The vector string says AV:N, but the advisory's FAQ discusses a local (AV:L) attack vector. This does not change the fix, but vulnerability scanners and scoring tools may display slightly different values. Operationally, AV:N does not override UI:R. The concrete file-opening requirement tells you more than the word "network" on its own.
Attack flow
Based on Microsoft's description, the documented sequence is:
- The attacker prepares a malicious Office file designed to reach the vulnerable Word processing path.
- The attacker sends the file to the target. The sources do not name a specific delivery channel.
- The attacker convinces the recipient to open the file. Microsoft explicitly states the Preview Pane is not an attack vector.
- Word processes the file, the heap buffer overflow occurs, and the attacker achieves code execution.
The sources do not establish a particular file extension, a macro requirement, or a need for the user to disable Protected View. We would not build exposure assessments around any of those assumptions.
Exploitation status
At original publication, Microsoft's advisory recorded Exploited: No, Publicly disclosed: No, and Exploitation Less Likely. CISA's SSVC enrichment in the CVE record, timestamped November 10, 2026 at 20:29:16.718808 UTC, recorded exploitation as none, automation as no, and technical impact as total. No threat actors, campaigns, or indicators are named in the reviewed material.
Avoid transferring intelligence from neighbouring bugs. ZDI's November review identifies CVE-2026-124194, an Outlook spoofing vulnerability, as under active attack, but that is a different identifier and product. CISA's November 10 notice added six other vulnerabilities to the Known Exploited Vulnerabilities catalog and does not name this CVE. All of these are dated assessments, not guarantees about later activity.
Patch information
Microsoft fixed CVE-2026-112741 in its November 10, 2026 Patch Tuesday release, and the advisory marks Remediation Level as Official Fix.
How the fix is delivered
The fix ships inside Microsoft's normal Office security builds, not as a separate hotfix. The November release patched 65 Word CVEs in total, so a single Office build update addresses this bug along with many other Word parsing flaws. You remediate by moving to a fixed build number, not by installing a specific KB for this CVE.
MSRC lists 9 product and architecture entries. NVD gives the same thresholds, with each build being the first fixed version:
- Microsoft Office LTSC 2024 (32 bit and 64 bit):
16.0.17932.21140 - Microsoft Office LTSC 2021 (32 bit and 64 bit):
16.0.14334.21048 - Microsoft Office LTSC for Mac 2024 (macOS):
16.115.26110837 - Microsoft Office LTSC for Mac 2021 (macOS):
16.115.26110837 - Microsoft Office 365 for Mac (macOS):
16.115.26110837 - Microsoft 365 Apps for Enterprise (32 bit and 64 bit): channel specific (see Microsoft Office Security Releases)
Microsoft 365 Apps is the one entry without a single build number. Its Click to Run update channels (Current, Monthly Enterprise, Semi Annual Enterprise, and others) each receive their own November build. For Windows SKUs, the advisory links to the Microsoft 365 Apps security updates release notes. For Mac SKUs, it links to the Office for Mac release notes.
What the patch probably changes
Microsoft has not published root cause details. Fixes for CWE-122 issues in document parsers usually do one of the following:
- Check a length or count field taken from the file against the size of the heap buffer it is about to fill.
- Fix the arithmetic that sizes the allocation, such as an integer truncation or overflow.
- Reject malformed records before copying them.
This is informed inference only. No source confirms which approach Microsoft used for this CVE.
Installing the update
- Windows: open Word (or another Office app), create a document, and go to File > Account > Update Options > Update Now. Select Enable Updates first if needed. If Update Options is missing, the install is likely managed through volume licensing or Group Policy. Use Microsoft Update or your help desk.
- Mac (installed from microsoft.com): Help > Check for Updates, then Update in Microsoft AutoUpdate. You can also enable Automatically keep Microsoft apps up to date.
- Mac (Mac App Store): use the store's Updates view and Update All, or update Word individually.
Verifying remediation
Compare the installed build against the list above:
- Windows: File > Account > About Word.
- macOS: Word > About Word.
Any build at or above the listed number has the fix. Microsoft 365 Apps installs pulling from an update channel normally receive the build automatically, but environments using WSUS, Configuration Manager, or a pinned channel build should confirm the November 2026 build has reached their machines.
A Mac documentation caveat: the advisory names 16.115.26110837 as the Mac baseline, but the general Office for Mac update history we reviewed still listed 16.114.4 (26110224), dated November 4, 2026, as its latest release. That older entry should not be read as evidence that the fixed baseline is installed.
Microsoft did not publish a workaround for this CVE. No source establishes a Preview Pane, macro setting, or registry change as a fix. Updating is the documented remediation.
Affected systems and versions
Version intervals from the CVE record and NVD:
- Microsoft Office LTSC 2021 (Windows, 32 bit and 64 bit): from 16.0.1 up to but not including 16.0.14334.21048
- Microsoft Office LTSC 2024 (Windows, 32 bit and 64 bit): from 16.0.0 up to but not including 16.0.17932.21140
- Microsoft Office LTSC for Mac 2021: from 16.0.1 up to but not including 16.115.26110837
- Microsoft Office LTSC for Mac 2024: from 16.0.0 up to but not including 16.115.26110837
- Microsoft Office 365 for Mac: from 1.0.0 up to but not including 16.115.26110837
- Microsoft 365 Apps for Enterprise (Windows, 32 bit and 64 bit): the record starts at 16.0.1 and uses the OfficeSecurityReleases URL as its upper boundary. That URL is a reference, not a comparable version number, and should not be read as one fixed build covering every channel.
The vulnerable configuration is any of the above builds where a user opens a malicious Office file. The target records do not establish that every Microsoft productivity product or deployment model is affected.
Vendor security history
The Cyber Safety Review Board's review of the summer 2023 Microsoft Exchange Online intrusion attributed the compromise of Microsoft's cloud environment to Storm-0558, a group associated with the government of the People's Republic of China. The Board concluded the intrusion was preventable, that it should never have occurred, and that Microsoft's security culture was inadequate and required an overhaul.
Microsoft's July 2026 Secure Future Initiative progress report describes its response under three principles, Secure by Design, Secure by Default, and Secure in Operations. It cites secure default configurations, tenant creation with drift detection, identity cleanup, and centrally governed build pipelines. These are vendor-reported changes rather than an independent finding that earlier deficiencies are resolved.
Neither source has any technical connection to this Word bug. There is no evidence Storm-0558 exploited CVE-2026-112741, and no evidence about whether the reforms influenced its discovery or repair. We include this history as context for how much weight to place on vendor program claims, not as a factor in the patching decision itself.
References
- Microsoft Security Update Guide: CVE-2026-112741
- NVD: CVE-2026-112741
- CVE Record (CVE Services API): CVE-2026-112741
- Microsoft Office Security Releases
- Release notes for Microsoft Office security updates
- Update history for Office for Mac
- How to update Microsoft 365 or Office for Windows
- Update Office for Mac automatically
- Cyber Security News: Microsoft November 2026 Patch Tuesday
- Tenable: Microsoft's November 2026 Patch Tuesday
- Zero Day Initiative: The November 2026 Security Update Review
- CISA Adds Six Known Exploited Vulnerabilities to Catalog
- CISA Known Exploited Vulnerabilities Catalog
- MITRE CWE-122: Heap Based Buffer Overflow
- CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft Secure Future Initiative Progress Report, July 2026
- Microsoft 2026 Annual Report
- Casco: CVE-2026-112741
