Introduction
A heap-based buffer overflow in Microsoft Office, fixed in Microsoft's November 10, 2026 Patch Tuesday release, gives an attacker a route to code execution on affected Windows and Mac endpoints when a user opens a specially crafted file. The affected product list spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and three Mac editions, each with its own fixed build. For defenders, the practical work is build verification across several distinct update streams.
Microsoft rates CVE-2026-116717 as Important, with a CNA CVSS 3.1 base score of 8.8 (High) and a temporal score of 7.7. NVD displays Microsoft's CNA score. NIST had not supplied its own score at the time of review because the record was awaiting enrichment. The vendor field in NVD reads Unknown, but the CVE record identifies Microsoft Corporation as both the vendor and the CVE Numbering Authority.
Technical information
Root cause
Microsoft classifies the weakness as CWE 122, Heap based Buffer Overflow. MITRE defines this as a condition where software writes past the end of a buffer allocated on the heap. In this weakness class, the resulting memory corruption can crash the process or, when adjacent heap data such as function pointers is overwritten, allow arbitrary code execution. Those are general CWE mechanisms, not a reconstruction of this specific Office defect.
Microsoft has not published root cause details. The advisory does not name the vulnerable function, the affected parser, the file format, the malformed field, the allocation size, or the corruption sequence. Office is closed source, so no public diff or commit exists to analyze. Any description of the bug more precise than "an Office component writes past a heap allocation while processing a crafted file" would go beyond what has been disclosed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack Vector: Network. The attack can originate remotely.
- Attack Complexity: Low. The published assessment does not require elevated complexity.
- Privileges Required: None. The attacker needs no prior authorization.
- User Interaction: Required. A user must act before exploitation occurs.
- Scope: Unchanged.
- Confidentiality, Integrity, Availability: High. Successful exploitation can fully affect all three.
The Network and User Interaction Required values apply together here. Remote delivery does not make this an automatically triggered network service exploit. The 7.7 temporal score reflects Microsoft's exploit maturity (Unproven) and remediation level (Official Fix) assessments.
Attack flow
The steps below follow the scenario described in Microsoft's FAQ:
- The attacker creates a specially crafted file designed to trigger the heap overflow in an affected Office build.
- The attacker gets the file to a target user. The advisory does not specify a delivery channel, so email, file shares, or downloads are not individually confirmed.
- The user opens the file in a vulnerable Office installation. The Preview Pane is explicitly not an attack vector, so merely receiving or previewing the document is not documented as sufficient.
- While processing the file, Office writes past the end of a heap buffer, corrupting adjacent memory.
- The corruption results in remote code execution, with high confidentiality, integrity, and availability impact per the CVSS assessment.
The advisory does not state that macros must be enabled, does not name a required file extension, and does not describe a Protected View bypass. It also does not identify any listening port or exposed service. These details are not publicly confirmed and should not be assumed when scoping exposure.
Exploitation status
At original publication, Microsoft marked the vulnerability as not publicly disclosed and not exploited, assessed it as Exploitation Less Likely, and set exploit code maturity to Unproven. Tenable states that no known exploits are available, and VulDB reports that neither detailed technical information nor an exploit is public. No reviewed source names a threat actor, campaign, malware family, or indicator of compromise. The finder is credited as Anonymous. We could not establish CISA KEV status from the catalog excerpt reviewed. These assessments describe the situation at publication and are not a guarantee about future exploitation.
Patch information
Microsoft shipped the fix in the November 10, 2026 Patch Tuesday release. The advisory's temporal vector includes RL:O, Remediation Level "Official Fix", which MSRC defines as "A complete vendor solution is available." Microsoft delivers the fix as patched Office builds, so the main verification task is confirming that each installation has reached the fixed build for its product and channel. Microsoft has published no separate workaround or configuration mitigation.
Fixed builds by product (MSRC Security Updates table)
- Microsoft 365 Apps for Enterprise (32 bit and 64 bit): depends on update channel, and Microsoft points to Office Security Releases
- Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140
- Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048
- Microsoft Office 365 for Mac: 16.115.26110837
- Office LTSC for Mac 2024: 16.115.26110837
- Office LTSC for Mac 2021: 16.115.26110837
Counting the separate 32-bit and 64-bit entries, that is nine product rows in MSRC. NVD's CNA data uses the same numbers as exclusive upper bounds.
Click to Run channel mapping (Windows)
Microsoft 365 Apps have no single fixed build because each channel moves on its own schedule. The Release notes for Microsoft Office security updates page lists CVE-2026-116717 under the Office suite for the November release:
- Current Channel: Version 2610 (Build 20527.20196)
- Monthly Enterprise Channel: 2610 (20527.20194), 2609 (20430.20264), 2608 (20326.20320)
- Semi Annual Enterprise Channel (receiving Monthly Enterprise builds): 2610 (20527.20192), 2609 (20430.20262), 2608 (20326.20318)
- Office 2024 / Office 2021 Retail: Version 2610 (Build 20527.20196)
- Office LTSC 2024 Volume Licensed: Version 2408 (Build 17932.21140)
- Office LTSC 2021 Volume Licensed: Version 2108 (Build 14334.21048)
The two LTSC volume-licensed builds match the MSRC numbers. A machine on one of these channels is patched once it reports at least the listed build for its channel and version.
macOS
On Mac, the fix ships in Office for Mac 16.115, build 26110837, installed through Microsoft AutoUpdate. The Office for Mac release notes list CVE-2026-116717 among the Office suite fixes for that release. Tenable's November 2026 Office plugin recommends updating Office for Mac to "16.115 or later", which is the short release label for the same full build boundary MSRC publishes. The plugin relies on the application's reported version and does not test the vulnerability, so its findings indicate patch level, not exploitation.
What the fix closes
Microsoft has not described the code change. Updates for heap overflows of this class typically add a bounds or length check so that a size value taken from the file cannot exceed the real buffer size before a copy. That is a general description of how such bugs are fixed, not something Microsoft has confirmed for this CVE.
Corrections to circulating patch information
- KB5002934 is not the fix for this CVE. It is an October 13, 2026 update for MSI-based Excel 2016. Its listed CVEs do not include CVE-2026-116717, and Excel 2016 is not among the affected products.
- Office LTSC 2021 does receive a fix. MSRC lists build 16.0.14334.21048 for both its 32-bit and 64-bit editions.
Affected systems and versions
Per the CVE record and MSRC advisory (upper bounds are exclusive):
- Microsoft 365 Apps for Enterprise, 32 bit and x64: from 16.0.1, with the update boundary following the Office security release information for the applicable channel (see channel builds above)
- Microsoft Office LTSC 2021, 32 bit and x64: from 16.0.1, before 16.0.14334.21048
- Microsoft Office LTSC 2024, 32 bit and x64: from 16.0.0, before 16.0.17932.21140
- Microsoft Office 365 for Mac: from 1.0.0, before 16.115.26110837
- Microsoft Office LTSC for Mac 2021: from 16.0.1, before 16.115.26110837
- Microsoft Office LTSC for Mac 2024: from 16.0.0, before 16.115.26110837
The vulnerable configuration is any of these installations below its fixed build where a user opens an attacker-supplied crafted file. No single numeric threshold works across a mixed fleet. The Windows LTSC editions use different fixed builds, Microsoft 365 Apps depend on channel, and the three Mac families share one boundary.
Vendor security history
The Cyber Safety Review Board reviewed the summer 2023 Exchange Online intrusion by the actor Microsoft tracks as Storm 0558, assessed as affiliated with the People's Republic of China, and concluded the intrusion was preventable. The Board identified operational and strategic decisions that collectively reflected a culture that deprioritized enterprise security investment and rigorous risk management. It recommended fundamental reforms backed by a publicly shared plan with specific timelines. DHS notes that Microsoft fully cooperated with the review.
Microsoft's November 2025 Secure Future Initiative progress report describes its Secure by Design, Secure by Default, and Secure Operations principles and maps progress to the NIST Cybersecurity Framework. It reports phishing-resistant multifactor authentication for 99.6% of employees and devices and central tracking of 98% of production infrastructure. These are vendor-reported program measures. Neither the 2023 incident nor these figures have any established connection to CVE-2026-116717, and there is no evidence that Storm 0558 exploited this vulnerability.
References
- NVD: CVE-2026-116717
- CVE Record: CVE-2026-116717
- Microsoft Security Update Guide: CVE-2026-116717
- Release notes for Microsoft Office security updates
- Release notes for Office for Mac
- Zero Day Initiative: The November 2026 Security Update Review
- Microsoft Support: KB5002934 (Excel 2016, not the fix for this CVE)
- Tenable Nessus Plugin 378503: Security Updates for Microsoft Office Products (November 2026)
- VulDB: CVE-2026-116717 Microsoft Office buffer overflow
- cve.now: CVE-2026-116717
- MITRE CWE 122: Heap based Buffer Overflow
- CISA Known Exploited Vulnerabilities Catalog
- CISA: CSRB Report on Summer 2023 Microsoft Exchange Online Intrusion
- DHS: Cyber Safety Review Board Releases Report on Microsoft Online Exchange Incident
- Microsoft SFI Progress Report November 2025
- Microsoft 2026 Annual Report
