Overview of CVE-2026-116718: Heap-Based Buffer Overflow in Microsoft Word Enabling Code Execution via Crafted Documents

Introduction

A single crafted document, opened in an unpatched copy of Microsoft Word, is the documented path to code execution for CVE-2026-116718, which Microsoft fixed in its November 10, 2026 Patch Tuesday release. Because Word runs on Windows and Mac endpoints across most enterprises, the practical question for defenders is less whether to patch and more which build each Office edition needs, since Microsoft publishes different fixed versions per product line.

Microsoft rates the flaw CVSS 3.1 base 7.5 with a product severity of Important. The impact ratings are high across confidentiality, integrity and availability, but Microsoft also documents meaningful constraints: the user has to open the file, the Preview Pane is not an attack vector, and exploitation depends on Word being able to allocate a large amount of memory while parsing the malicious document.

Technical information

Root cause: heap buffer corruption during document processing

Microsoft classifies the weakness as CWE-122: Heap based Buffer Overflow. MITRE defines this class as a condition where data is written past the end of a buffer allocated on the heap. Class-level consequences include crashes and arbitrary code execution, which explains the risk category, but they do not tell us the precise internal corruption mechanism in this specific Word bug.

The advisory FAQ adds one concrete technical detail. Exploitation:

requires the affected application to be able to allocate a large amount of memory while processing a specially crafted document.

That statement suggests the bug lives somewhere in how Word handles size values taken from the document file when it allocates or fills a heap buffer. Microsoft has not published root cause or code-level details, and Word is closed source, so there is no public commit, diff or vulnerable function name to examine. We are deliberately not reconstructing internals beyond what Microsoft has stated.

Attack flow as documented by Microsoft

Based on the advisory FAQ, the documented exploitation scenario looks like this:

The attacker builds a specially crafted Office document designed to trigger the heap overflow in Word's document processing.
The attacker sends the malicious file to the target. The advisory does not name a delivery channel or a specific file extension.
The attacker convinces the recipient to open the file. According to Microsoft, viewing it in the Preview Pane alone is not an attack vector.
While Word processes the document, the application must be able to allocate a large amount of memory. Microsoft ties this requirement directly to the high attack complexity rating.
If those conditions are met, the heap corruption can lead to code execution.

The advisory does not establish that macros must be enabled, that a security feature must be bypassed, that the attacker gains administrator privileges, or what object layout or payload is involved.

CVSS breakdown

Microsoft publishes the following vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

AV:N (Network): the vector is network classified, paired with the malicious file delivery scenario.
AC:H (High): exploitation depends on extra conditions, including the large memory allocation requirement.
PR:N (None): no prior access privileges are needed.
UI:R (Required): the user must open the malicious file.
S:U (Unchanged): impact stays within the same security authority.
C:H / I:H / A:H: high impact on confidentiality, integrity and availability.
E:U / RL:O / RC:C: exploit maturity Unproven, remediation level Official Fix, report confidence Confirmed.

The base score is 7.5 and the temporal score is 6.5. NVD reproduces Microsoft's base assessment, and NIST has not supplied its own. "Network" here does not mean interaction free, and high impact does not mean exploitation is straightforward. Microsoft's Important severity, the 7.5 base score and the Exploitation Less Likely rating answer different questions (product severity, standardized technical severity and assessed exploitability) rather than contradicting each other.

Exploitability assessment at publication

The advisory, at revision 1.0 (November 10, 2026), reports:

Exploited: No
Publicly disclosed: No
Exploitability: Exploitation Less Likely
Exploit maturity: Unproven (E:U), which Microsoft defines as no publicly available exploit code, or an exploit that is theoretical

We found no named threat actor, campaign, exploit sample, file hash or network indicator in the available reporting. Microsoft credits Kentaro Kawane of GMO Cybersecurity by Ierae, Inc. for reporting the issue through coordinated disclosure. That is a researcher credit, not attribution. The fair summary is that the available reporting shows no confirmed active campaign, which is a narrower claim than saying nobody has attempted exploitation.

Patch information

Microsoft fixed CVE-2026-116718 in its November 10, 2026 Patch Tuesday release. The Security Update Guide sets the CVSS Remediation Level to Official Fix, which Microsoft defines as meaning "a complete vendor solution is available." The CNA record on CVE.org tags the MSRC advisory as both a vendor advisory and a patch reference. Since Word is closed source, the verifiable artifacts are the fixed build numbers.

Fixed builds

Microsoft Office LTSC 2024 (32 bit and 64 bit): vulnerable from 16.0.0 to below 16.0.17932.21140. First fixed build 16.0.17932.21140, delivered through Click to Run and the Microsoft 365 Apps security update channel (Microsoft 365 Apps security update release notes).
Microsoft 365 Apps for Enterprise (32 bit and 64 bit): vulnerable from 16.0.1 to below the current secure build. The fixed build depends on your update channel. See Office Security Releases.
Microsoft Office 365 for Mac: vulnerable from 1.0.0 to below 16.115.26110837. First fixed build 16.115.26110837, via Microsoft AutoUpdate (Office for Mac release notes).
Microsoft Office LTSC for Mac 2021: vulnerable from 16.0.1 to below 16.115.26110837. First fixed build 16.115.26110837, via Microsoft AutoUpdate.
Microsoft Office LTSC for Mac 2024: vulnerable from 16.0.0 to below 16.115.26110837. First fixed build 16.115.26110837, via Microsoft AutoUpdate.

Reading these versions correctly

Microsoft 365 Apps has no single fixed build. Both the CVE record and the MSRC table use https://aka.ms/OfficeSecurityReleases as the version limit instead of a build number. Microsoft 365 Apps ships on several channels at once (Current, Monthly Enterprise, Semi Annual Enterprise and others), and each channel gets its own patched build. Look up the November 2026 security build for your channel and compare it with the version shown under File > Account > About Word. Applying the LTSC 2024 build number as a universal Office target would misread the product mapping.
On Mac, Office 365 for Mac, LTSC for Mac 2021 and LTSC for Mac 2024 all share the fixed build 16.115.26110837. Any Mac installation at that build or later has the fix.
LTSC 2024 on Windows is a Click to Run product. It is patched through the Office update mechanism, not a standalone MSI KB package, and the MSRC table links to the Microsoft 365 Apps security update release notes rather than a separate KB download. No specific KB numbers are asserted here.

Applying the update

Windows: open an Office application such as Word, create a document, then select File > Account > Update Options > Update Now. If Update Now is not visible, select Enable Updates first. If Update Options is missing entirely, Microsoft notes that volume licensing or Group Policy may apply, and directs users to Microsoft Update or their help desk.
Mac (installed from Microsoft): open an Office application and choose Help > Check for Updates, then Update. Microsoft also documents the Automatically keep Microsoft apps up to date option. For Mac App Store installations, use the App Store's Updates interface.
Managed Mac fleets: Microsoft documents either letting devices download updates or distributing them through organizational software deployment tools, with control over Microsoft AutoUpdate preferences and installation deadlines. Individual security updates cannot be downloaded and installed separately in this Mac update model.

The advisory documents no CVE-specific workaround, so the official product update is the remediation path.

What the fix probably changes (inference, not confirmed by Microsoft)

Given the CWE-122 classification and the FAQ's reference to large memory allocation while processing a crafted document, fixes for this class of bug typically validate that sizes and lengths declared in the file fit within the buffer actually allocated, and that size calculations cannot overflow. The parser then rejects the malformed structure before writing past the end of the buffer. Microsoft has not released root cause details, so treat this as an educated guess rather than a description of the actual code change.

The advisory remains at revision 1.0, and Microsoft has not revised or reissued the fix since publication.

Affected systems and versions

Per the Microsoft-supplied CVE record (reproduced by NVD):

Microsoft 365 Apps for Enterprise, Windows 32 bit and x64: from 16.0.1, with an upper boundary that references the Office security releases page rather than a numeric version.
Microsoft Office LTSC 2024, Windows 32 bit and x64: 16.0.0 up to, but not including, 16.0.17932.21140.
Microsoft Office 365 for Mac: 1.0.0 up to, but not including, 16.115.26110837.
Microsoft Office LTSC for Mac 2021: 16.0.1 up to, but not including, 16.115.26110837.
Microsoft Office LTSC for Mac 2024: 16.0.0 up to, but not including, 16.115.26110837.

The vulnerable configuration in all cases is an unpatched Word installation in which a user opens a malicious document. The Preview Pane alone is not an attack vector.

Vendor security history

Microsoft is both the affected vendor and the assigning CNA. Its 2026 annual report positions Microsoft 365 Commercial as a productivity platform combining Office, Windows, Microsoft 365 Copilot and Enterprise Mobility + Security, which is why Word flaws land on patch lists across most enterprise fleets.

The most substantive independent assessment of Microsoft's security track record is the Cyber Safety Review Board's review of the Summer 2023 Exchange Online intrusion. The Board found the intrusion preventable, judged Microsoft's security culture inadequate, and noted that Microsoft did not detect the compromise of a signing key until a customer reported anomalies. Paused manual key rotation, an incomplete move to automatic rotation and the absence of aging key alerts left a 2016 MSA key valid in 2023.

Microsoft's July 2026 Secure Future Initiative progress report describes the company's response, including 99.97% coverage for phishing-resistant MFA enforcement, decommissioning of 1.4 million unused Entra applications, and remediation of more than 550,000 critical and high-risk open-source vulnerability instances. These are vendor-reported outcomes. Neither the Exchange case nor the SFI figures has any technical or actor connection to CVE-2026-116718. Organization-wide security progress and a newly disclosed memory safety bug in a large closed-source application can coexist.

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical information