Introduction
A heap buffer overflow in Microsoft Office Word, fixed in Microsoft's November 10, 2026 security release, lets an attacker run code on a victim's machine once that victim opens a specially crafted document. Microsoft reported no exploitation at publication. Even so, the affected code ships in Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and the corresponding Mac editions, so the update applies to a large share of enterprise desktops.
Microsoft's CNA scores CVE-2026-116719 at CVSS 3.1 8.8 (High), while the MSRC advisory uses its own severity label, Important. The two labels come from different rating systems and do not conflict. Below we summarize what is known about the flaw, what is not, which builds fix it, and how it fits into Microsoft's recent security record.
Technical information
Root cause
Microsoft classifies the weakness as CWE-122 (heap-based buffer overflow). MITRE defines this class as writing beyond the end of a buffer allocated on the heap. In general, the consequences range from application crashes to arbitrary code execution, for example when the overflow corrupts adjacent heap memory such as function pointers.
For this specific CVE, Microsoft confirms only two things: a heap buffer overflow in Word allows an unauthorized attacker to execute code over a network, and exploitation requires a user to open a specially crafted file. Word is closed source, no public diff exists, and the MSRC affected-product records leave the affectedBinaries field empty for every entry, so Microsoft has not said which Word module changed.
Some general background, which may or may not apply here. Heap overflows in document parsers typically occur when the parser copies data from the file into a heap buffer without verifying that the data fits. The usual fix validates lengths and counts read from the file against the real buffer size, or allocates buffers from validated sizes. Microsoft has not confirmed that this is how CVE-2026-116719 works or how it was fixed.
What the sources do not disclose
The public record does not specify:
- The vulnerable function or the faulty allocation or bounds calculation
- The file structure or required file extension
- Whether macros are involved
- The overwrite primitive or any reproducible exploit sequence
- Whether any exploit mitigation must be bypassed
- The privilege level under which resulting code would execute
VulDB likewise lists technical details as unknown. The available information is enough for remediation planning, but not for building a reliable exploit, a vulnerability-specific detector or a forensic signature.
CVSS breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Attack Vector: Network. Classified as a remote attack.
- Attack Complexity: Low. The scoring model assumes no specialized access conditions.
- Privileges Required: None. The attacker needs no prior authorization.
- User Interaction: Required. The user must open the crafted file.
- Scope: Unchanged. Impact stays within the same security authority.
- Confidentiality, Integrity, Availability: High. The potential consequences for affected resources are severe.
- Exploit Code Maturity: Unproven. No public exploit code exists, or exploitation remains theoretical.
- Remediation Level: Official Fix. A complete vendor patch is available.
- Report Confidence: Confirmed.
Microsoft reports a base score of 8.8 and a temporal score of 7.7. NVD displays Microsoft's CNA score but has not published a separate NIST assessment, so the 8.8 should not be attributed to an independent NIST calculation.
The Network attack vector does not mean that merely receiving a document, previewing it or exposing an unrelated network service triggers the bug. Microsoft states explicitly that the Preview Pane is not an attack vector. The patched code path runs when Word fully opens the document.
Attack flow
Based on Microsoft's documented scenario, exploitation proceeds as follows:
- The attacker prepares a specially crafted file designed to trigger the heap overflow in Word.
- The attacker delivers the file to a target and persuades the user to open it.
- The user opens the file in Word (not merely in the Preview Pane).
- While Word processes the document, data is written past the end of a heap buffer.
- If the attacker successfully controls the resulting memory corruption, they achieve code execution, with high potential impact to confidentiality, integrity and availability.
Exploitation status at publication
At original publication, Microsoft's advisory recorded "Exploited: No", "Publicly disclosed: No" and "Exploitation Less Likely". CISA's SSVC enrichment for this CVE recorded exploitation as "none", automation as "no" and technical impact as "total". VulDB states no exploit is publicly available. The reviewed reporting ties no threat actor, campaign or indicators to this CVE, and the retrieved CISA KEV catalog content did not include it.
Low attack complexity and Exploitation Less Likely do not contradict each other. The CVSS metric describes attack conditions, whereas Microsoft's exploitability index forecasts how likely working exploits are. Both should be read alongside the file-opening requirement.
Patch information
Microsoft fixed CVE-2026-116719 on November 10, 2026, as part of the November 2026 Patch Tuesday release. The advisory sets Remediation Level to Official Fix, and all nine product and platform entries in Microsoft's affected-product data carry productStatus: fixed. Advisory revision 1.0 (November 10, 2026, Information published) is the only revision so far, so the fix has not been reissued or modified.
Fixed builds by product
- Microsoft Office LTSC 2024 (32-bit and 64-bit):
16.0.17932.21140, documented in the Microsoft 365 Apps security update notes - Microsoft Office LTSC 2021 (32-bit and 64-bit):
16.0.14334.21048, documented in the Microsoft 365 Apps security update notes - Microsoft 365 Apps for Enterprise (32-bit and 64-bit): depends on update channel, see Office Security Releases
- Microsoft Office 365 for Mac:
16.115.26110837, documented in the Office for Mac release notes - Microsoft Office LTSC for Mac 2021:
16.115.26110837 - Microsoft Office LTSC for Mac 2024:
16.115.26110837
Microsoft's November 10 release notes list LTSC 2021 Version 2108, Build 14334.21048, and LTSC 2024 Version 2408, Build 17932.21140, matching the fixed boundaries above.
How the fix is delivered
- Microsoft 365 Apps for Enterprise: there is no single fixed build. Each update channel (Current, Monthly Enterprise, Semi Annual and others) received its own patched build that month. Compare a machine's channel and build against the November 10, 2026 entry in the Microsoft 365 Apps security update notes.
- Office LTSC 2021 and 2024 on Windows: these are Click to Run products, so the fix arrives as a new build with no separate KB installer. Check the build under File > Account > About Word. A build at or above the listed number includes the fix.
- Mac products: all three share fixed build
16.115.26110837, delivered through Microsoft AutoUpdate and listed in the Office for Mac release notes. Check under Word > About Word.
For Windows users, Microsoft documents updating via File > Account > Update Options > Update Now. If only About appears, the installation may be governed by volume licensing or Group Policy. For managed fleets, Microsoft documents the Office Deployment Tool and the Group Policy settings that enable updates, set an update path and set an update deadline. Updates normally download in the background and apply when applications close.
Microsoft marks customerActionRequired: true for every entry, meaning a system remains vulnerable until the updated build is installed and Word restarts. The advisory states no workaround, and generic CWE-122 defenses such as operating system memory protections are not a substitute for the vendor fix.
Publication caveats
Two supporting pages disagree with the advisory. Microsoft's general Office security index lists this CVE under Access, while the specific advisory and CNA record identify Word. Separately, the Office for Mac update history retrieved for the briefing listed November 4, 2026, Version 16.114.4 (26110224), rather than the advisory boundary 16.115.26110837. Neither discrepancy means Access is affected or that the older Mac build is remediated. Rely on the advisory boundary.
Affected systems and versions
NVD and Microsoft's CNA record list the following ranges. Each range includes the lower bound and excludes the fixed build.
- Microsoft 365 Apps for Enterprise (32-bit and x64): from 16.0.1, with the upper boundary given in the Office Security Releases for the applicable channel
- Microsoft Office LTSC 2021 (32-bit and x64): 16.0.1 up to, but not including, 16.0.14334.21048
- Microsoft Office LTSC 2024 (32-bit and x64): 16.0.0 up to, but not including, 16.0.17932.21140
- Microsoft Office 365 for Mac: 1.0.0 up to, but not including, 16.115.26110837
- Microsoft Office LTSC for Mac 2021: 16.0.1 up to, but not including, 16.115.26110837
- Microsoft Office LTSC for Mac 2024: 16.0.0 up to, but not including, 16.115.26110837
The Windows entries count separately for 32-bit and x64, giving nine product and platform entries in total.
Vendor security history
The Cyber Safety Review Board's review of the 2023 Exchange Online intrusion described how Storm-0558, an actor assessed as affiliated with the People's Republic of China and pursuing espionage, used authentication tokens signed with a Microsoft key and exploited a token validation flaw. The Board found that Microsoft's operational and strategic decisions collectively indicated a corporate culture that deprioritized enterprise security investment and rigorous risk management. It also noted that victims lacked visibility into necessary data, because at the time historical logs were unavailable to customers without premium licenses.
Microsoft's July 2026 Secure Future Initiative progress report describes security as a continuing investment across culture, governance and engineering. Some objectives are at their target state and others are still in progress, and the governance changes focus on accountability and reducing organizational silos.
Taken together, the two sources show documented historical failures alongside substantial but unfinished reform. Neither discusses this Word CVE, and the Exchange Online case concerned cloud identity and email, not Office document parsing. Storm-0558 has no documented connection to CVE-2026-116719.
References
- MSRC Security Update Guide: CVE-2026-116719
- MSRC affected product API data for CVE-2026-116719
- NVD: CVE-2026-116719
- CVE record (CVE Services API)
- VulDB entry 434055
- MITRE CWE-122: Heap based Buffer Overflow
- Microsoft 365 Apps security update release notes
- Office for Mac release notes
- Office for Mac update history
- Office Security Releases
- How to update Microsoft 365 or Office for Windows
- Keep Office apps up to date with the latest updates
- CISA Known Exploited Vulnerabilities Catalog
- CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft SFI Progress Report, July 2026
- Microsoft 2026 Annual Report
- European Commission: Microsoft Teams commitments decision
