Introduction
Microsoft's November 2026 Patch Tuesday included a fix for a heap buffer overflow in Microsoft Office Word that can let an unauthorized attacker execute code over a network, provided a user takes some action. Because the affected products span Microsoft 365 Apps channels, fixed LTSC releases and three Mac editions, each with its own build threshold, getting this one fully remediated is mostly an exercise in knowing exactly what you have installed.
Technical information
Root cause
Microsoft classifies CVE-2026-116925 as CWE-122: Heap Based Buffer Overflow. MITRE defines this as an overflow condition affecting a buffer allocated in the heap portion of memory. In this class of flaw, Word copies data from a crafted document into a heap buffer without properly checking its length, and the resulting memory corruption can lead to code execution.
That is about as far as the public record goes. Microsoft has not said which Word routine or file format structure it changed, and the advisory does not publish the corrupted object, the heap layout, or the control-flow sequence. The disclosure also does not establish:
- a particular file extension or document parser
- a macro requirement
- the privilege level of the resulting code
- numeric truncation or any other specific arithmetic cause
As general background, MITRE notes that heap overflows can be used to overwrite function pointers and redirect execution to attacker-controlled code. That describes the weakness class. It has not been confirmed as the exploitation technique for this CVE.
CVSS breakdown
Microsoft publishes the following base and temporal vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Confidentiality, Integrity, Availability: High across all three
- Temporal: E:U/RL:O/RC:C, meaning Unproven exploit code maturity, an Official Fix, and Confirmed report confidence
The base score is 8.8 (High in NVD, while Microsoft's own product severity is Important) and the temporal score is 7.7. These are different score types, not competing base scores. NVD currently displays the Microsoft CNA score and vector, has not supplied an independent NIST score, and marks the record as Awaiting Enrichment.
Attack flow
Based only on what Microsoft has published, the documented attack conditions look like this:
- The attacker needs no prior privileges on the target (PR:N), and the assessed vector is Network (AV:N).
- Attacker-supplied content reaches Word. The patch notes frame the bug class as Word processing data from a crafted document, but they do not specify the delivery medium.
- A user must act. UI:R appears alongside AV:N, so network reachability does not remove the interaction prerequisite. Microsoft's only FAQ entry for this CVE states that the Preview Pane is not an attack vector. The FAQ does not say what the required user action is, so claiming that opening a specific crafted file is the confirmed trigger would go beyond the disclosure.
- Word writes past the bounds of a heap allocation, corrupting the heap.
- Successful exploitation results in code execution with high potential impact to confidentiality, integrity and availability, within an unchanged scope.
The exact trigger and exploit internals remain undisclosed, which limits technical reconstruction but has no bearing on whether the patches apply.
Severity versus likelihood
An 8.8 base score and an Exploitation Less Likely rating are not contradictory. The vector describes attack prerequisites and potential impact. Microsoft's exploitability index is a separate judgment about the likelihood of exploitation. The CISA SSVC assessment in the CVE record makes the same distinction, pairing a technical impact of total with automatable: no and exploitation: none.
Patch information
Microsoft fixed CVE-2026-116925 in its November 10, 2026 Patch Tuesday release. Word is closed source, so there is no public commit or diff to study. The fix ships as updated binaries, and you confirm it by checking the build number. The Remediation Level is RL:O (Official Fix), which MSRC defines as "A complete vendor solution is available." Microsoft does not publish a separate workaround for this CVE.
Fixed builds
The MSRC Security Update Guide lists nine product and platform entries, all released on November 10, 2026. Any build older than the one listed is vulnerable:
- Microsoft Office LTSC 2024 (32 bit and 64 bit):
16.0.17932.21140 - Microsoft Office LTSC 2021 (32 bit and 64 bit):
16.0.14334.21048 - Microsoft Office 365 for Mac:
16.115.26110837 - Microsoft Office LTSC for Mac 2024:
16.115.26110837 - Microsoft Office LTSC for Mac 2021:
16.115.26110837 - Microsoft 365 Apps for Enterprise (32 bit and 64 bit): no single build number. MSRC points to Office Security Releases
NVD's affected products data, which comes from Microsoft as the CNA, matches these numbers and uses them as the exclusive upper limit of each affected range.
How to tell if you're patched
- Microsoft 365 Apps on Windows: Updates arrive through Click to Run, and the fixed build depends on your update channel (Current, Monthly Enterprise, Semi Annual and so on). Compare the build shown under File > Account > About Word with the November 2026 build listed for your channel in the Microsoft 365 Apps security updates release notes.
- LTSC 2021 and 2024: The build must be at least the value listed above.
- Mac: All three Mac products share one fixed build,
16.115.26110837, delivered through Microsoft AutoUpdate and documented in the Office for Mac release notes.
Installing the update
- Windows: Microsoft's support guidance is to open an Office app such as Word, then select File > Account > Update Options > Update Now, choosing Enable Updates first if needed. If Update Options is missing and only About appears, Microsoft points to volume licensing or Group Policy management as likely explanations and directs users to Microsoft Update or their help desk.
- Mac: Open an Office app, select Help > Check for Updates, then choose Update or Update All in Microsoft AutoUpdate and restart the app when it finishes.
- Managed fleets: Microsoft recommends letting Microsoft 365 Apps devices update directly from the Office CDN. Its documentation distinguishes downloading an update from applying it. Pending updates can be applied at Windows startup, and Office can close open apps when a configured update deadline is reached. Verify the installed version afterward rather than assuming a download means a fix.
There is also a documentation quirk. The Office security release notes list this CVE under Access, while the dedicated MSRC advisory and the CNA record identify Word. We follow the dedicated records. Placement in the release notes does not on its own establish a separate Access vulnerability.
Correcting the upstream reports
One upstream report called this a zero day exploited before the fix. Microsoft's advisory does not support that. At publication it listed the bug as Publicly disclosed: No and Exploited: No, with an assessment of Exploitation Less Likely and exploit code maturity of Unproven. The ZDI November 2026 review also lists it as not public and not exploited, and the CISA SSVC assessment records exploitation as none. The flaw was patched through normal coordinated disclosure, and the reporter is credited as "Anonymous", which is an acknowledgement, not threat actor attribution. No actor, campaign, or indicators are associated with this CVE in the reviewed material. These are publication-time assessments, so they describe the state at release rather than guaranteeing future attacker behavior.
Affected systems and versions
Per the Microsoft CNA record and MSRC advisory:
- Microsoft 365 Apps for Enterprise (32 bit and 64 bit): from 16.0.1. The upper boundary refers to Office security releases, so the fixed build is the applicable November 2026 release for your update channel
- Microsoft Office LTSC 2021 (32 bit and 64 bit): from 16.0.1 up to but not including 16.0.14334.21048
- Microsoft Office LTSC 2024 (32 bit and 64 bit): from 16.0.0 up to but not including 16.0.17932.21140
- Microsoft Office 365 for Mac: from 1.0.0 up to but not including 16.115.26110837
- Microsoft Office LTSC for Mac 2021: from 16.0.1 up to but not including 16.115.26110837
- Microsoft Office LTSC for Mac 2024: from 16.0.0 up to but not including 16.115.26110837
The disclosure identifies no specific vulnerable configuration (such as a macro setting or file type), and it explicitly excludes the Preview Pane as an attack vector.
Vendor security history
The most relevant independent assessment of Microsoft's recent security record is the Cyber Safety Review Board's review of the 2023 Exchange Online intrusion. The Board concluded that the intrusion was preventable and should never have occurred, identified avoidable errors, and found Microsoft's security culture inadequate and in need of an overhaul. It called for direct CEO and board attention and a public reform plan with specific timelines.
Microsoft's November 2025 Secure Future Initiative progress report describes its response: expanded Deputy CISO functions, secure defaults and hardware trust improvements in Azure, and governance changes for Microsoft 365, organized around Secure by Design, Secure by Default, and Secure Operations. These are vendor-reported initiatives.
Neither document concerns this Word heap overflow, and neither establishes its cause or any exploitation. They are context for how Microsoft operates, while the direct evidence for this case remains the advisory and the published fixes.
References
- NVD: CVE-2026-116925
- CVE Record (CVE Services API): CVE-2026-116925
- Microsoft Security Update Guide: CVE-2026-116925
- ZDI: The November 2026 Security Update Review (thezdi.com)
- ZDI: The November 2026 Security Update Review (zerodayinitiative.com)
- Release notes for Microsoft Office security updates
- Office Security Releases
- Office for Mac release notes
- How to update Microsoft 365 or Office for Windows
- Update Microsoft 365 or Office on your macOS or iOS device
- Overview of the update process for Microsoft 365 Apps
- CWE-122: Heap Based Buffer Overflow
- BleepingComputer: Microsoft November 2026 Patch Tuesday coverage
- CSRB: Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft Security Blog: November 2025 Secure Future Initiative progress report
- Microsoft Form 10K filed 07/29/2026
- Reuters: Microsoft to lift productivity suite prices for businesses, governments
