Quick Look: Microsoft Office CVE-2026-120003 Heap-Based Buffer Overflow Reachable Through the Preview Pane

Introduction

A heap-based buffer overflow in Microsoft Office, fixed in the November 10, 2026 Patch Tuesday release, can give an attacker code execution with the targeted user's privileges when a crafted file is simply rendered in the Preview Pane. Microsoft files the bug under the shared "Office suite" component rather than a single app, so the fix touches Microsoft 365 Apps, Office LTSC on Windows, and Office for Mac, each with its own build boundary.

Microsoft rates CVE-2026-120003 as Critical, while the CVSS 3.1 base score is 8.8 (High). The two ratings come from different severity scales and do not conflict. At release, Microsoft reported the issue as not exploited, not publicly disclosed, and Exploitation Less Likely.

Technical information

Root cause

MSRC classifies the flaw as CWE 122: Heap based Buffer Overflow. In this class of bug, Office copies attacker-controlled data from a document into a heap buffer that is too small to hold it. MITRE notes that heap overflows can overwrite adjacent memory, including function pointers, and can lead to arbitrary code execution or application crashes. That description covers the weakness class in general and does not reconstruct how this specific bug is exploited.

Microsoft has not disclosed the affected parser or function, the malformed file format, the specific allocation error, heap layout details, or a reproducible exploitation sequence. Any claim about the exact code change would be speculation, and Office is closed source, so there is no public commit or diff to inspect.

Where the vulnerable code lives

Microsoft's Office security release notes list CVE-2026-120003 under Office suite, not under Word, Excel, PowerPoint, or Outlook. That placement suggests the fix is in a component shared across the Office applications, so a single update addresses every app that uses it. The November 10, 2026 Mac release notes likewise list the CVE under the Office Suite section.

CVSS vector

The published base vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• AV:N: Network
• AC:L: Low complexity
• PR:N: No privileges required
• UI:R: User interaction required
• S:U: Scope unchanged
• C:H / I:H / A:H: High confidentiality, integrity, and availability impact

Microsoft also publishes a 7.7 temporal score with E:U/RL:O/RC:C: Unproven exploit maturity, Official Fix, and Confirmed report confidence. The temporal score does not replace the 8.8 base score.

Attack flow

Based on Microsoft's FAQ and CrowdStrike's November 2026 Patch Tuesday analysis, the documented pattern looks like this:

1. The attacker prepares a malicious document or email containing content that triggers the heap overflow.
2. The content is delivered to the target over the network, which is what the AV:N rating reflects.
3. The victim selects the item, and Office renders it in the Preview Pane. Microsoft explicitly confirms the Preview Pane is an attack vector, so the file does not need to be opened in a separate application window.
4. Rendering reaches the vulnerable code path, the overflow corrupts heap memory, and code runs with the user's privileges.

UI:R and the Preview Pane vector are consistent, because the required interaction can be nothing more than selecting an item for preview. The Network vector also does not imply that Office exposes a standalone remotely reachable service, and the cited sources do not establish any separate elevation to administrator or SYSTEM.

Exploitation status

• Microsoft's release assessment: Exploited: No, Publicly disclosed: No, Exploitation Less Likely. The disclosure field refers to the state at original publication.
• OffSeq reports no public exploit indexed in Metasploit or Exploit DB and no CISA Known Exploited Vulnerabilities listing.
• No threat actor, campaign, file hash, or command-and-control indicator is associated with this CVE in the consulted sources.

Release intelligence is not a guarantee. We would describe the CVE as not reported exploited, and would stop short of calling it an active zero day.

Patch information

Microsoft fixed CVE-2026-120003 in the November 10, 2026 Patch Tuesday release. The MSRC advisory sets Remediation Level to Official Fix (RL:O). The fix ships only as updated Office binaries, and you confirm it by checking build numbers. Installing the updated build is what removes the vulnerable code path reachable through preview rendering.

Windows: LTSC editions

MSRC lists these minimum fixed builds for the volume-licensed perpetual editions (32 bit and 64 bit):

• Office LTSC 2024: 16.0.17932.21140 (Version 2408)
• Office LTSC 2021: 16.0.14334.21048 (Version 2108)

Windows: Microsoft 365 Apps and Retail

For Microsoft 365 Apps for Enterprise, MSRC gives no single build and points to aka.ms/OfficeSecurityReleases, because each update channel gets its own build. The November 10, 2026 entry lists:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office 2024 Retail and Office 2021 Retail: Version 2610 (Build 20527.20196)

Click to Run Office is versioned per channel. A machine is patched only if it runs a build at or above the November build for its own channel and version. A higher version number on a different channel does not confirm the fix. In Office, File > Account > About shows the exact version and build.

macOS

Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024 are all fixed in Version 16.115 (Build 26110837), which NVD's affected version data expresses as < 16.115.26110837. Microsoft's update history provides update packages for existing installations and installation packages for applications not already installed.

Delivery

• Click to Run (Microsoft 365 Apps, Retail, LTSC): the fix arrives through the normal Office update channel, whether automatic updates, Configuration Manager or Intune, or the Office Deployment Tool. No separate KB installer is needed.
• Mac: the fix comes through Microsoft AutoUpdate (MAU) or the Mac App Store.

Qualys and Rapid7 both list the CVE in the November 2026 release with the same RL:O vector, matching Microsoft's advisory.

A note on adjacent preview controls

Microsoft documents no CVE-specific workaround. Windows File Explorer's automatic preview restriction for internet-marked files, introduced with security updates released on and after October 14, 2025, is documented in the context of preventing NTLM hash leakage. It does not reference this CVE and should not be treated as a substitute for the Office update.

Affected systems and versions

Per the CVE record and NVD data:

• Microsoft 365 Apps for Enterprise: from 16.0.1; the upper boundary is defined per channel by Microsoft's security release page (see channel builds above)
• Microsoft Office 365 for Mac: from 1.0.0, before 16.115.26110837
• Microsoft Office LTSC 2021: from 16.0.1, before 16.0.14334.21048
• Microsoft Office LTSC 2024: from 16.0.0, before 16.0.17932.21140
• Microsoft Office LTSC for Mac 2021: from 16.0.1, before 16.115.26110837
• Microsoft Office LTSC for Mac 2024: from 16.0.0, before 16.115.26110837

The Preview Pane is a documented exposure path on affected builds. Tenable's November 2026 Office for Mac plugin recommends Office for Mac 16.115 or later. The plugin relies on the reported application version and does not test the issue itself.

Vendor security history

The Cyber Safety Review Board's review of the 2023 Exchange Online intrusion found that mailboxes belonging to 22 organizations and over 500 individuals were compromised using authentication tokens signed with a Microsoft key created in 2016. The Board concluded the intrusion was preventable and that Microsoft's security culture was inadequate and required an overhaul.

In June 2024, Microsoft said it was acting on all 16 applicable CSRB recommendations and adding 18 security objectives under its Secure Future Initiative. Its July 2026 progress report states that 93% of critical and high-value build pipelines use centrally governed templates and over 81% of services emit critical security logs in a standard format. These are Microsoft-reported figures. The 2023 cloud identity incident has no documented connection to CVE-2026-120003.

References

• MSRC Security Update Guide: CVE-2026-120003
• NVD: CVE-2026-120003
• CVE Record: CVE-2026-120003
• Microsoft Office Security Releases (aka.ms/OfficeSecurityReleases)
• Release notes for Microsoft Office security updates
• Release notes for Office for Mac
• Update history for Office for Mac
• Qualys: Microsoft Patch Tuesday November 2026 Security Update Review
• Rapid7 Vulnerability Database: CVE-2026-120003
• CrowdStrike: November 2026 Patch Tuesday Updates and Analysis
• Tenable Nessus Plugin 378503: Security Updates for Microsoft Office Products (November 2026)
• OffSeq Threat Radar: CVE-2026-120003
• MITRE CWE 122: Heap based Buffer Overflow
• Microsoft Support: File Explorer automatically disables the preview feature for files downloaded from the internet
• GridinSoft: Microsoft Word Preview Pane RCE Bugs Put Outlook Users at Risk
• CISA: Cyber Safety Review Board Report on Summer 2023 Microsoft Online Exchange Incident
• CSRB: Review of the Summer 2023 Microsoft Exchange Online Intrusion (PDF)
• Microsoft On the Issues: Microsoft's work to strengthen cybersecurity protection
• Microsoft Trust Center: SFI Progress Report July 2026
• Microsoft 2026 Annual Report