Quick Look: Microsoft Word CVE-2026-116720 Heap-Based Buffer Overflow Leading to Remote Code Execution

Introduction

A heap-based buffer overflow in Microsoft Office Word, fixed in the November 10, 2026 Patch Tuesday release, allows an attacker to execute code on a machine when a user opens a specially crafted document. The affected range spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and three Office for Mac editions, so for most organizations the practical work is matching every installation to the correct channel and fixed build.

Technical information

Root cause

Microsoft describes CVE-2026-116720 as a heap-based buffer overflow in Word that "allows an unauthorized attacker to execute code over a network." The weakness is classified as CWE-122, which MITRE defines as writing beyond the end of a buffer allocated on the heap.

MITRE notes that buffer overflows of this class generally cause crashes and can also enable arbitrary code execution, with corruption of function pointers given as one possible mechanism. That is general background on the weakness class. It is not a published account of how this particular Word bug is exploited.

Several details are not public. The Microsoft advisory does not identify:

• the affected Word function or parser
• the triggering file extension or format
• the corrupted memory structure or instruction sequence
• whether macros need to be enabled

Word is closed source, and Microsoft has not published a diff, commit, or root-cause write-up. We therefore have no vulnerable code to show, and any claim about a specific document format or macro-based trigger would go beyond the evidence.

Attack vector and conditions

Microsoft's base vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

That is a network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact to confidentiality, integrity, and availability. The network classification has to be read together with the user interaction requirement. It reflects remote delivery of a file, not an independently reachable network service.

The advisory FAQ states that the Preview Pane is not an attack vector. The vulnerable code therefore runs when a document is fully opened in Word, which places the flaw in Word's file-handling path rather than in the preview handler.

Attack flow

Based on the advisory, the documented sequence is short:

1. The attacker prepares a specially crafted file that triggers the heap overflow in Word. The sources do not describe its structure.
2. The attacker supplies that file to a target user. The sources do not specify a delivery channel.
3. The user opens the file in an affected Word build. Viewing it in the Preview Pane does not trigger the bug.
4. Word writes past the end of a heap buffer during file handling, which can lead to code execution. The sources do not establish whether this yields administrator or SYSTEM-level execution. The reasonable reading is that code runs in the context of the Word process.

Scoring and severity

Microsoft publishes a base score of 8.8 (HIGH) and a temporal score of 7.7, using the extended vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Exploit code maturity is Unproven, remediation level is Official Fix, and report confidence is Confirmed. Report confidence refers to the vulnerability itself. It does not mean an attack has been confirmed.

Microsoft's own severity rating is Important. One upstream summary described the issue as critical, but that does not match the vendor rating. Both the Zero Day Initiative and BleepingComputer November roundups list it as an Important Word RCE with a CVSS of 8.8. CVSS and Microsoft's severity scale are separate systems, so an 8.8 HIGH score alongside an Important rating is not a contradiction.

NVD lists the record as Awaiting Analysis, and the 8.8 score comes from Microsoft rather than from an independent NVD assessment.

Exploitation status at publication

Microsoft's assessment at original publication on November 10, 2026:

• Publicly disclosed: No
• Exploited: No
• Exploitability assessment: Exploitation Less Likely

CISA's SSVC enrichment in the NVD record lists exploitation as none, automatable as no, and technical impact as total. VulDB separately states that no exploit is available and confirms the user interaction requirement. We found no threat actor attribution, campaign, file hashes, or public proof of concept tied to this CVE in the reviewed material. These are point-in-time assessments, and they can change.

Patch information

Microsoft shipped an official fix with the November 10, 2026 Patch Tuesday release. The advisory revision history contains a single entry, version 1.0 ("Information published") dated November 10, 2026, so the fix and the disclosure went out together. The Remediation Level of Official Fix (RL:O) indicates that a complete vendor solution exists.

What the patch changes

Microsoft has not published technical detail on the code change. The only fix information is the patched build numbers. In the CWE-122 bug class generally, fixes in document parsers typically add or correct a length or bounds check so that a size value taken from the file is not trusted when data is copied into a heap buffer. That describes the bug class. It is not confirmed detail about this fix.

How the fix is delivered

• Windows: The MSRC knowledge base entries for Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps point to the Microsoft 365 Apps security updates release notes. These are Click to Run products, so the fix arrives as a newer full Office build rather than a standalone .msp hotfix. The advisory does not list separate KB numbers for these entries.
• Mac: The Mac products link to the Office for Mac release notes. The fix arrives through Microsoft AutoUpdate, or a managed deployment, as version 16.115.26110837.

Microsoft 365 Apps channel builds

Microsoft 365 Apps ships through several update channels, and each channel receives the fix in its own build. That is why the advisory points to the Office Security Releases page instead of naming one version. The November 10, 2026 security release notes list CVE-2026-116720 among the addressed vulnerabilities with these builds:

Use the entry that matches the installation's channel and supported version. Builds from different channels are not interchangeable.

Applying the update

Windows: Open an Office application such as Word, create a new document, select File > Account, then Update Options > Update Now. Select Enable Updates first if needed. If Update Options is missing, Microsoft notes the installation may be managed through volume licensing or Group Policy, in which case updates come through Microsoft Update or the organization's help desk.

Mac: Open an Office application, select Help > Check for Updates, choose Update or Update All in Microsoft AutoUpdate, and restart the application when finished.

Verifying patch state

Compare the installed Office version with the fixed thresholds. On Windows, check File > Account > About Word; on Mac, use Word > About Word. A device on the right channel but below the listed build has not yet received the November 2026 fix.

At the time the briefing sources were retrieved, the general Office for Mac release notes did not yet include a November 10 entry or this CVE, while the advisory and the CVE record already specified 16.115.26110837. That gap does not by itself indicate the package is unavailable.

On workarounds

The advisory contains no dedicated mitigation or workaround section. Microsoft documents Protected View as a read-only mode for potentially unsafe files and recommends leaving it only when the source and content are trusted, but the reviewed sources do not confirm that Protected View blocks CVE-2026-116720. MITRE describes operating system memory protections as defense in depth rather than a complete answer to heap overflows. The supported remediation is the Office update.

Affected systems and versions

The NVD record, sourced from Microsoft, treats every version below these thresholds as affected. Windows entries cover both 32-bit and x64 platforms.

The exposure condition is an affected installation fully opening an attacker-supplied file. No additional configuration requirements are documented.

Vendor security history

Microsoft is the affected vendor and the assigning CNA, and its reach in productivity software is substantial. In September 2025 the European Commission stated that its investigation preliminarily found Microsoft dominant in the worldwide market for professional SaaS productivity applications, while accepting legally binding commitments on Teams. That is not a Word market share figure, but it explains why Office patch hygiene affects so many organizations.

The Cyber Safety Review Board's review of the summer 2023 Exchange Online intrusion is the most significant independent assessment of Microsoft's recent security record. The Board found that a threat actor associated with the government of the People's Republic of China used forged tokens signed with a Microsoft consumer signing key to access official email accounts. It concluded the intrusion was preventable, criticized delayed correction of inaccurate public statements, and said Microsoft's security culture required an overhaul. That incident concerned cloud identity, not Word document parsing, and is unrelated to this CVE.

Microsoft's July 2026 Secure Future Initiative progress report describes embedding Zero Trust controls into platforms, engineering pipelines, and governance. It reports that 93% of critical and high-value build pipelines use centrally governed templates and that more than 550,000 instances of critical and high-risk open source vulnerabilities were remediated. These are vendor-reported outcomes. For CVE-2026-116720, the concrete vendor response is the advisory, the published affected ranges, and the official fix.

References

• Microsoft Security Update Guide: CVE-2026-116720
• NVD: CVE-2026-116720
• CVE Program record for CVE-2026-116720
• NVD API record for CVE-2026-116720
• Zero Day Initiative: The November 2026 Security Update Review
• BleepingComputer: Microsoft November 2026 Patch Tuesday
• Cybersecurity News: Microsoft November 2026 Patch Tuesday
• Office Security Releases
• Release notes for Microsoft Office security updates
• Release notes for Office for Mac
• How to update Microsoft 365 or Office for Windows
• Update Microsoft 365 or Office on your macOS or iOS device
• What is Protected View?
• VulDB entry for CVE-2026-116720
• MITRE CWE-122: Heap Based Buffer Overflow
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft SFI Progress Report July 2026
• European Commission: commitments offered by Microsoft related to Teams