Brief Summary: Microsoft Word CVE-2026-116722 Heap-Based Buffer Overflow Leading to Remote Code Execution

Introduction

Microsoft's November 2026 Office security release fixes a heap-based buffer overflow in Word that lets an attacker run code on a victim's machine once the victim opens a specially crafted file. The affected range covers Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and three Office for Mac products, so the fix spans both subscription and perpetual deployments on two platforms.

The issue, tracked as CVE-2026-116722, carries a CVSS 3.1 base score of 8.8 (High) in the Microsoft-supplied rating recorded by NVD. Microsoft's own severity label is Important. Keep both labels in view instead of collapsing them into a single "critical" framing.

At publication, Microsoft's advisory recorded the vulnerability as "Publicly disclosed: No", "Exploited: No" and "Exploitation Less Likely". The NVD record also carries a CISA Coordinator SSVC assessment, timestamped November 10, 2026 at 19:57:44 UTC, with exploitation none, automatable no, and technical impact total. The reviewed Microsoft and NVD records name no threat actor, campaign, sample or public exploit code. These assessments are dated and can change.

Technical Information

Root cause

Microsoft classifies the bug as CWE-122, Heap-based Buffer Overflow. MITRE defines this weakness as a write beyond the end of a buffer allocated on the heap. As general background, MITRE notes that heap overflows can crash the process and, in some cases, overwrite adjacent data such as function pointers to redirect execution. That description covers the weakness class. Microsoft has not published a reconstruction of this particular Word bug.

Word is closed source, and there is no public commit, diff or source-level write-up. The reviewed primary records do not disclose:

• the vulnerable function or parser component
• the document format, extension or malformed file structure involved
• the allocation size calculation or the corrupted object
• the overwrite offset, payload or a reproducible exploit chain
• whether exploitation interacts with Protected View, requires a specific document feature, or grants privileges beyond those of the Word process

Reading the CVSS vector correctly

The vector supplied by Microsoft, and recorded in NVD, is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector: Network. Remote delivery of the malicious file is within the attack model.
• Attack Complexity: Low. No high-complexity conditions are assigned.
• Privileges Required: None. The attacker needs no prior access.
• User Interaction: Required. A user must open the crafted file.
• Scope: Unchanged.
• Confidentiality, Integrity, Availability: High.

Microsoft also publishes a temporal score of 7.7, with Remediation Level set to Official Fix (RL:O). NVD still marks the record as Awaiting Analysis, so these values are Microsoft's CNA assessment rather than an independent NVD scoring.

The description's phrase "execute code over a network" is broader than the scenario Microsoft describes. The network vector reflects how the file reaches the victim. It does not indicate an unauthenticated network service that can be compromised without user action.

Attack flow

Based on Microsoft's advisory FAQ, the disclosed attack sequence is:

1. Crafting. The attacker builds a specially crafted file that triggers the heap overflow when Word processes it. The format and the structure that triggers the overflow are not disclosed.
2. Delivery. The attacker gets the file to a target user. The advisory does not name a delivery channel or service.
3. User action. The target opens the file in Word. Microsoft explicitly states that the Preview Pane is not an attack vector, so merely previewing the file is not the disclosed trigger.
4. Memory corruption. While Word processes the file, data is written past the end of a heap buffer.
5. Code execution. Successful exploitation results in code execution with high impact to confidentiality, integrity and availability, with scope unchanged.

What the fix most likely changes

Microsoft has not described the code change. Given the bug class and the file-opening trigger, the fix most likely adds or corrects a bounds check in Word's document processing code. That check would validate a length, count or offset read from the file against the size of the destination heap buffer, and reject or truncate bad data instead of writing past the end. This is an inference from how such fixes typically look. No public source confirms it.

Patch Information

Microsoft fixed CVE-2026-116722 in its November 2026 Office security release, published November 10, 2026. The fix ships only as updated Office builds. The MSRC advisory sets Remediation Level to Official Fix, which Microsoft defines as a complete vendor solution, either a patch or an upgrade. In the MSRC Security Update Guide API, all nine affected product entries for this CVE carry productStatus: "fixed" and customerActionRequired: true. The patch exists, but a system is protected only once the new build is installed.

First fixed builds by product

• Microsoft Office LTSC 2021 (32-bit and 64-bit): 16.0.14334.21048
• Microsoft Office LTSC 2024 (32-bit and 64-bit): 16.0.17932.21140
• Microsoft 365 Apps for Enterprise (32-bit and 64-bit): the November 2026 build for your update channel, listed in the Office security release notes
• Microsoft Office 365 for Mac: 16.115.26110837
• Microsoft Office LTSC for Mac 2021: 16.115.26110837
• Microsoft Office LTSC for Mac 2024: 16.115.26110837

NVD shows the same boundaries from Microsoft's CNA data as exclusive upper limits, so any build at or above the listed number contains the fix. Microsoft's November 10 Office security release table lists 14334.21048 for LTSC 2021 and 17932.21140 for LTSC 2024, which match the NVD boundaries.

Why Microsoft 365 Apps has no single build number

Microsoft 365 Apps ships on several update channels at once: Current, Monthly Enterprise and Semi Annual Enterprise. Each channel receives its own November build, so MSRC points to the Office security release notes instead of a single number. Identify your channel, then compare the installed build with the November 10, 2026 entry for that channel. Each LTSC line likewise has its own build, while the three Mac products share one unified build, 16.115.26110837.

Delivery

• Windows (Click to Run: Microsoft 365 Apps and LTSC 2021/2024): the updated build arrives through the normal Office update mechanism, governed by your update channel, Intune, Configuration Manager or Office Deployment Tool policy. Updates are cumulative, so later builds also contain this fix. For a manual update, open an Office application, select File > Account, then Update Options > Update Now (choose Enable Updates first if it is offered).
• macOS: the fix ships in Office for Mac 16.115.26110837 through Microsoft AutoUpdate, as listed in the Office for Mac release notes. Users can select Help > Check for Updates in Word. Mac App Store installations update through the App Store Updates page. For managed fleets, Microsoft supports distributing the updated application bundle with software distribution tools and recommends installation deadlines. Individual Mac security updates cannot be installed separately. The replacement application bundle contains them.

Verifying the fix

Open File > Account > About Word on Windows, or Word > About Word on macOS, and compare the version with the builds above.

Publication inconsistencies worth knowing

• The general Office security release page groups this identifier under Access, whereas the CVE-specific MSRC advisory and the NVD description identify Word.
• The Office for Mac update history reviewed in the briefing reached November 4, version 16.114.4 (build 26110224), and did not yet corroborate the 16.115.26110837 boundary documented by NVD. Confirm that this exact Mac build is available in your AutoUpdate or distribution tooling before closing out remediation.

Microsoft documents no vulnerability-specific workaround. Disabling the Preview Pane is not a fix, since the Preview Pane is not an attack vector, and generic memory-safety hardening is not a substitute for the update.

Affected Systems and Versions

According to the NVD record, built from Microsoft's CNA data, the following products are affected (upper bounds are excluded, meaning that build and later are fixed):

• Microsoft 365 Apps for Enterprise, Windows 32-bit and x64: from 16.0.1, up to the November 10, 2026 security build for the relevant update channel
• Microsoft Office LTSC 2021, Windows 32-bit and x64: from 16.0.1 up to but not including 16.0.14334.21048
• Microsoft Office LTSC 2024, Windows 32-bit and x64: from 16.0.0 up to but not including 16.0.17932.21140
• Microsoft Office 365 for Mac: from 1.0.0 up to but not including 16.115.26110837
• Microsoft Office LTSC for Mac 2021: from 16.0.1 up to but not including 16.115.26110837
• Microsoft Office LTSC for Mac 2024: from 16.0.0 up to but not including 16.115.26110837

The vulnerable configuration is any of these installations where a user opens an attacker-supplied file in Word.

Vendor Security History

Microsoft is both the affected vendor and the CNA that assigned this CVE. For broader context on its security posture, the Cyber Safety Review Board's review of the 2023 Exchange Online intrusion found that Storm 0558, an actor the Board assessed as pursuing espionage objectives with ties to the People's Republic of China, compromised Exchange Online mailboxes including accounts at 22 enterprise organizations. The Board concluded that the intrusion should never have happened and attributed it to a cascade of Microsoft security failures.

Microsoft's July 2026 Secure Future Initiative progress report describes its subsequent program, built on Secure by Design, Secure by Default and Secure in Operations. The report claims 99.97% phishing-resistant MFA coverage, 93% adoption of centrally governed templates in critical and high-value build pipelines, and remediation of more than 550,000 critical and high-risk open-source vulnerability instances. These are self-reported, program-wide figures.

Neither the Storm 0558 incident nor the SFI program has any established technical connection to CVE-2026-116722, and no reviewed source links Storm 0558 to this CVE. Patching decisions should rest on the installed Word build rather than on the vendor's overall posture.

References

• NVD: CVE-2026-116722
• Microsoft Security Update Guide: CVE-2026-116722, Microsoft Office Word Remote Code Execution Vulnerability
• MSRC Security Update Guide API: affected products for CVE-2026-116722
• NVD API record for CVE-2026-116722
• MITRE CWE-122: Heap-based Buffer Overflow
• Release notes for Microsoft Office security updates
• Release notes for Office for Mac
• Update history for Office for Mac
• Update Office for Mac automatically
• Deploy updates for Office for Mac
• How to update Microsoft 365 or Office for Windows
• CISA Known Exploited Vulnerabilities Catalog
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft SFI Progress Report, July 2026
• Microsoft 2026 Annual Report
• VulDB entry for CVE-2026-116722