Introduction
Microsoft Word is part of nearly every enterprise document workflow, so a memory corruption bug in how it processes files deserves a careful read even when there is no sign of active exploitation. CVE-2026-116923, a heap-based buffer overflow fixed in Microsoft's November 10, 2026 security release, can lead to remote code execution when a user opens a crafted document, and it spans Office editions on both Windows and Mac.
Microsoft assigns a CVSS v3.1 base score of 8.8 (High) and an advisory severity of Important. At original publication, Microsoft reported the issue as not exploited and not publicly disclosed, with an assessment of Exploitation Less Likely. Below we summarize what is known, what is not, and which builds close the hole.
Technical information
Root cause
Microsoft's description is brief: "Heap based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network." The weakness is classified as CWE-122, which MITRE defines as writing past the end of a buffer allocated on the heap.
That classification names the failure category. It does not say where in Word the bug sits. Microsoft has not disclosed the affected parser, function, file format, malformed field, or corruption sequence. VulDB likewise lists the vulnerable function as unknown and states that technical details and an exploit are unavailable. No vulnerable code has been published, and since Office is closed source there is no public commit or diff to examine.
The bug class implies only a little, but that little is useful. While handling attacker-controlled data from a document, Word writes beyond the bounds of a heap allocation. Corrupting adjacent heap memory in this way is the primitive that Microsoft assesses can lead to code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack Vector: Network. Remote delivery is within the assessed attack model.
- Attack Complexity: Low. The scoring model requires no specialized access conditions or extenuating circumstances.
- Privileges Required: None. The attacker needs no prior authorization.
- User Interaction: Required. Microsoft's FAQ identifies this as opening the crafted file.
- Scope: Unchanged. Impact stays within resources managed by the same security authority.
- Confidentiality, Integrity, Availability: High. Total loss of each is possible within the impacted component.
Microsoft's temporal assessment sets Remediation Level to Official Fix (RL:O), which lowers the temporal score to 7.7.
Attack flow
Based on Microsoft's advisory, the documented scenario is:
- The attacker prepares a specially crafted file designed to trigger the heap overflow in Word. The required file structure has not been disclosed.
- The attacker supplies that file to a target. Microsoft does not specify a particular delivery channel, and the CVSS model treats delivery as network based.
- The user opens the file in Word. Microsoft explicitly states that the Preview Pane is not an attack vector, so according to the advisory, receiving or previewing the document is not sufficient.
- While processing the file, Word writes past the end of a heap buffer, which Microsoft assesses can result in code execution with high confidentiality, integrity, and availability impact.
Severity versus likelihood
The 8.8 base score and the Exploitation Less Likely assessment answer different questions. FIRST's CVSS v3.1 specification separates Base metrics, which describe intrinsic characteristics, from Temporal metrics such as exploit code maturity. Low attack complexity in the vector does not imply a published exploit or an active campaign.
Exploitation status
- Microsoft at original publication: not publicly disclosed, not exploited, Exploitation Less Likely.
- CISA enrichment in the CVE record: Exploitation is none, Automatable is no, and Technical Impact is total.
- No threat actor, campaign, victim set, or delivery infrastructure is attributed to this CVE in the Microsoft and CNA records, and VulDB reports no available exploit.
- CISA KEV catalog membership could not be established from the available material.
These are dated findings. They support saying that no exploitation was reported at disclosure, not that exploitation cannot emerge later. MSRC credits Kentaro Kawane of GMO Cybersecurity by Ierae, Inc. with the report, which indicates coordinated disclosure.
Patch information
Microsoft fixed CVE-2026-116923 in its November 10, 2026 security release (Patch Tuesday). The fix ships as updated Office binaries, so verification comes down to confirming that each installation has reached a fixed build number. MSRC lists nine affected product entries (counting 32-bit and 64-bit variants separately), all patched on the same day.
Fixed builds by product line
- Microsoft Office LTSC 2024 (32-bit and 64-bit):
16.0.17932.21140 - Microsoft Office LTSC 2021 (32-bit and 64-bit):
16.0.14334.21048 - Microsoft Office LTSC for Mac 2024:
16.115.26110837 - Microsoft Office LTSC for Mac 2021:
16.115.26110837 - Microsoft Office 365 for Mac:
16.115.26110837 - Microsoft 365 Apps for Enterprise (32-bit and 64-bit): delivered through the November 10, 2026 Office security release, with builds per channel listed below
For Windows LTSC, the security release notes list Office LTSC 2024 Version 2408, Build 17932.21140, and Office LTSC 2021 Version 2108, Build 14334.21048. These match the excluded upper boundaries in the NVD record.
Microsoft 365 Apps channel builds
Microsoft 365 Apps has no single fixed build. Microsoft's release notes for Office security updates list CVE-2026-116923 under the "Office suite" heading of the November 10, 2026 release, not under the Word-specific heading. The builds containing the fix are:
- Current Channel: Version 2610 (Build 20527.20196)
- Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
- Semiannual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
If you manage Click to Run clients by channel, confirm that each client has reached the build for its channel. A client on the right version (for example, 2609) but an older build number is still vulnerable.
Mac
MSRC gives 16.115.26110837 as the fixed build for all Mac SKUs, and the Office for Mac release notes show Version 16.115 (Build 26110837) shipped on November 10, 2026. However, CVE-2026-116923 does not appear among the CVEs listed under Word in those Mac notes, so the MSRC build mapping is the authoritative source for the Mac fix.
What the patch changes
Microsoft has published no technical details about the fix. Fixes for heap overflows typically add bounds or length checks before data is copied into a buffer, or correct how the buffer size is calculated. Without a binary diff of old and new Word builds, it is not possible to confirm which approach Microsoft took. Because the Preview Pane is not an attack vector, the patched code path is reached when a user actually opens a crafted file.
Applying the update
- Windows: open an Office application, create a document, and select File > Account > Update Options > Update Now, selecting Enable Updates first if needed. If Update Options is missing, volume licensing or Group Policy may be involved. Microsoft points users toward Microsoft Update or their organization's help desk.
- Mac: select Help > Check for Updates, then Update or Update All in Microsoft AutoUpdate, and restart the application.
No CVE-specific workaround or individual KB number was identified in the advisory and CNA material. Microsoft's Protected View opens files from the Internet and other potentially unsafe locations in a read-only mode and remains sensible general guidance, but the available sources do not establish that it blocks this vulnerability. Treat it as a general precaution, not a substitute for the update.
Affected systems and versions
The ranges below come from Microsoft's CNA record (reflected in NVD). The upper boundary is excluded from the affected range.
- Microsoft 365 Apps for Enterprise (Windows, 32-bit and x64): from
16.0.1, with the upper boundary given by the Office security release information for each channel - Microsoft Office 365 for Mac: from
1.0.0up to but not including16.115.26110837 - Microsoft Office LTSC 2021 (Windows, 32-bit and x64): from
16.0.1up to but not including16.0.14334.21048 - Microsoft Office LTSC 2024 (Windows, 32-bit and x64): from
16.0.0up to but not including16.0.17932.21140 - Microsoft Office LTSC for Mac 2021: from
16.0.1up to but not including16.115.26110837 - Microsoft Office LTSC for Mac 2024: from
16.0.0up to but not including16.115.26110837
A generic "Office version" check is not enough, because the boundary depends on the installed product, and for Microsoft 365 Apps it also depends on the servicing channel. These are the disclosed ranges, not a statement that every earlier historical release was assessed.
Vendor security history
The European Commission describes Microsoft as a global technology company offering productivity and business software, cloud computing, and personal computing. In September 2025 it stated that it had preliminarily found Microsoft to hold a dominant position in the worldwide market for SaaS productivity applications for professional use. That is a qualified regulatory finding, not a count of vulnerable Word installations.
In its March 2024 review of the summer 2023 Exchange Online intrusion, the Cyber Safety Review Board concluded that the intrusion should never have happened and that Microsoft's security culture was inadequate. The Board recommended clearer communication about what is known and unknown during investigations. That incident is separate from this Word bug, and nothing links the two.
Microsoft's November 2025 Secure Future Initiative report describes self-reported progress mapped to the NIST Cybersecurity Framework: 95% of employees completing assigned security training, 95% of Microsoft Entra ID signing virtual machines moved to Azure Confidential Compute, phishing-resistant MFA enforced for 99.6% of employees and devices, central tracking of 98% of production infrastructure, two-year log retention, and more than 50 new detections. These are vendor statements, not independent verification.
References
- NVD: CVE-2026-116923
- CVE Program record for CVE-2026-116923
- Microsoft Security Update Guide: CVE-2026-116923
- NVD API record for CVE-2026-116923
- Release notes for Microsoft Office security updates (aka.ms)
- Release notes for Microsoft Office security updates (Microsoft Learn)
- Release notes for Office for Mac
- Update history for Office LTSC 2024 and Office 2024
- CWE-122: Heap Based Buffer Overflow
- VulDB entry for CVE-2026-116923
- What is Protected View? (Microsoft Support)
- How to update Microsoft 365 or Office for Windows
- Update Microsoft 365 or Office on macOS or iOS
- CVSS v3.1 Specification Document (FIRST)
- CISA Known Exploited Vulnerabilities Catalog
- CISA KEV JSON feed
- CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft SFI Progress Report, November 2025
- European Commission press release on Microsoft commitments
