Brief Summary: Microsoft Office CVE-2026-122198 Heap-Based Buffer Overflow Allowing Code Execution When a Folder Is Viewed

Introduction

A heap memory corruption bug in Microsoft Office, fixed on November 10, 2026, can let an attacker run code as the logged-on user when that user simply views a folder containing a malicious file. Because the victim never has to open the document, the familiar reasoning that "nobody opened the attachment" does not settle whether a workstation was exposed.

Microsoft rates CVE-2026-122198 at CVSS 3.1 8.8 (High) and sets its own advisory severity to Important. At publication, Microsoft reported the issue as not exploited and not publicly disclosed, and assessed it as Exploitation Less Likely. This post is a short review of what Microsoft has disclosed, which builds contain the fix, and where the public information stops.

Technical Information

Root cause

Microsoft describes the flaw as a heap-based buffer overflow in Microsoft Office that allows an unauthorized attacker to execute code over a network. The weakness is classified as CWE-122, which MITRE defines as a buffer overflow condition where the overwritten buffer was allocated on the heap. MITRE notes that heap overflows as a class can corrupt memory and in some cases overwrite function pointers to gain code execution. That is background on the weakness class. Microsoft has not confirmed that this CVE uses any particular pointer overwrite or exploitation technique.

The patch metadata offers one structural clue. Microsoft's Office security release notes list CVE-2026-122198 under the "Office suite" heading for November 10, 2026, rather than under Word, Excel, or another single application. That placement suggests the vulnerable code sits in a shared Office component used by several apps.

What Microsoft has and has not disclosed

The advisory establishes:

• The weakness class (heap-based buffer overflow, CWE-122)
• The interaction requirement: viewing a folder containing a crafted file
• That opening the file is not required
• That the Preview Pane is not an attack vector
• That code runs with the permissions of the affected user
• That the attacker does not need an account on the target system

The advisory does not disclose the file handler, file extension, vulnerable function, memory layout, overwrite primitive, mitigation bypass, payload, or reproduction steps. Office is closed source, so there is no public commit or diff to examine. Attributing the trigger to thumbnail generation, icon handling, or a specific Office parser would go beyond the published evidence, and we have not done so here.

CVSS vector

Microsoft publishes the following base vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• AV:N Network attack vector
• AC:L Low attack complexity, no specialized access conditions
• PR:N No privileges required
• UI:R User interaction required
• S:U Scope unchanged
• C:H / I:H / A:H High confidentiality, integrity, and availability impact

The base score is 8.8 and the temporal score is 7.7. NVD currently displays Microsoft's CNA score. NVD has not provided its own assessment, and the record is marked Awaiting Enrichment.

Attack flow

Based solely on Microsoft's advisory, the documented scenario proceeds as follows:

1. The attacker prepares a specially crafted file that triggers the heap overflow in the affected Office component.
2. The attacker persuades a target user to view a folder that contains this file.
3. The user does not open the file. Viewing the folder is sufficient for the documented scenario, and the Preview Pane is not the trigger.
4. The heap overflow occurs, and successful exploitation results in code execution with the permissions of that user.
5. The attacker needs no prior account or authorization on the target system.

The interaction requirement is real but minimal. The user must take an action (UI:R), yet that action is less than what defenders typically associate with document-based attacks.

Exploitation status

Microsoft's assessment at original publication:

• Exploited: No
• Publicly disclosed: No
• Exploitability assessment: Exploitation Less Likely
• Exploit code maturity: Unproven (no publicly available exploit code, or the exploit is theoretical)
• Acknowledgement: an anonymous researcher, via coordinated disclosure

No threat actor or campaign is named in the advisory or the CVE record. The anonymous credit acknowledges a researcher and says nothing about attackers. A high-impact score and a lower reported likelihood answer different questions, so they do not contradict each other. The score describes prerequisites and consequences, while the exploitability fields describe the threat situation Microsoft observed at release.

Patch Information

Microsoft fixed CVE-2026-122198 in its November 10, 2026 Patch Tuesday release. The update replaces the affected Office binaries with builds that handle the memory correctly. On the advisory, the CVSS temporal Remediation Level is set to Official Fix, meaning a complete vendor solution is available, which is why the temporal score drops from 8.8 to 7.7.

Because the issue is listed under "Office suite," updating a single application is not a meaningful unit of remediation. The whole Office installation needs to move to a fixed build. Office is serviced through Click to Run, so the fix arrives as a new build number rather than a separate KB file.

Fixed builds: LTSC

• Office LTSC 2024 (32-bit and x64): vulnerable from 16.0.0 up to, but not including, 16.0.17932.21140. Fixed in 16.0.17932.21140 (Version 2408).
• Office LTSC 2021 (32-bit and x64): vulnerable from 16.0.1 up to, but not including, 16.0.14334.21048. Fixed in 16.0.14334.21048 (Version 2108).

Microsoft documents LTSC updates as cumulative, so the latest available release includes earlier security and quality fixes. Moving to the current cumulative update is fine, since the November boundary is a minimum rather than the only acceptable destination.

Fixed builds: Microsoft 365 Apps and Retail

The advisory does not give a single build number for Microsoft 365 Apps for Enterprise. Instead it points to the Office security release notes, which list these November 10, 2026 builds:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office 2024 Retail and Office 2021 Retail: Version 2610 (Build 20527.20196)

Reading the build boundary

The previous security release on October 13, 2026 shipped LTSC 2024 Build 17932.21056 and LTSC 2021 Build 14334.20974. Both precede the fixed versions, so a machine that is current only to October is still vulnerable.

For the Monthly and Semi Annual Enterprise Channels, each supported version line receives its own fixed build. You do not need to be on the newest version, but you do need the November build for the version you run. For example, Version 2608 is fixed at 20326.20320 on Monthly Enterprise and at 20326.20318 on Semi Annual Enterprise.

Verifying and applying the update

To check the installed build, open any Office application, go to File > Account, and read the version under About in the Product Information area. Compare it against the boundaries above.

Microsoft's documented user-initiated update procedure:

1. Open an Office application, such as Word, and create a document.
2. Select File > Account.
3. Under Product Information, select Update Options > Update Now.
4. If necessary, select Enable Updates first.

For centrally managed LTSC deployments, Microsoft documents updating from the Office CDN, an internal shared folder, Group Policy configuration, or Microsoft Configuration Manager.

What is not a workaround

• Preview Pane: Microsoft excludes it as an attack vector. Disabling it is not documented remediation for this CVE.
• Protected View: Microsoft documents it as a general mode that disables most editing for potentially unsafe files, and advises enabling editing only for trusted content. The reviewed sources do not establish it as protection against this CVE's folder-viewing trigger.

Advisory metadata: version 1.0, published November 10, 2026 ("Information published"), with no revisions issued since.

Affected Systems and Versions

Per the CVE record and Microsoft's advisory:

• Microsoft 365 Apps for Enterprise, 32-bit and x64: affected from 16.0.1, with the upper boundary expressed through Microsoft's Office security release reference (see the channel builds above).
• Microsoft Office LTSC 2021, 32-bit and x64: 16.0.1 up to, but not including, 16.0.14334.21048.
• Microsoft Office LTSC 2024, 32-bit and x64: 16.0.0 up to, but not including, 16.0.17932.21140.
• Office 2024 Retail and Office 2021 Retail: the November 10, 2026 release notes list Version 2610 (Build 20527.20196) as the fixed build.

No specific configuration beyond running an affected build has been published as a precondition. Match remediation to the product actually installed rather than to every product carrying the Office name.

Vendor Security History

Microsoft is the confirmed vendor and the assigning CNA. Two sources bear on its broader security record, with clear limits on how they apply here.

The Cyber Safety Review Board's review of the Summer 2023 Exchange Online intrusion found that Microsoft failed to detect the compromise of critical cryptographic material and relied on a customer to identify anomalies. The Board also found that Microsoft did not know how the attacker obtained the signing key, lacked evidence for its earlier crash dump explanation, and was slow to correct that inaccurate public account. Its recommendations emphasized transparency about what is known and unknown. That was a cloud identity incident and has no established connection to this Office vulnerability.

Microsoft's July 2026 Secure Future Initiative progress report describes self-reported outcomes, including 99.97% phishing-resistant MFA coverage for users and devices, 93% of critical and high-value build pipelines using centrally governed templates, roughly 3M container vulnerability instances addressed monthly, and public access removed from 732,000 resources. These are Microsoft's own metrics about identity, pipelines, containers, and resource exposure. None of them measures Office memory safety or independently validates this fix.

For the weakness class itself, CISA and the FBI's Secure by Design guidance on buffer overflows recommends memory-safe languages where feasible, compiler protections, sanitizer-based testing, static analysis, fuzzing, and root cause analysis. Those measures are for software manufacturers. Customers cannot apply them as settings to installed Office binaries.

References

• Microsoft Security Update Guide: CVE-2026-122198
• NVD: CVE-2026-122198
• CVE Record: CVE-2026-122198
• Release notes for Microsoft Office security updates
• Update history for Office LTSC 2021 and Office 2021
• Update history for Office LTSC 2024 and Office 2024
• Update Office LTSC 2021
• Update Office LTSC 2024
• How to update Microsoft 365 or Office for Windows
• What is Protected View?
• Zero Day Initiative: The November 2026 Security Update Review
• MITRE CWE-122: Heap based Buffer Overflow
• CISA Secure by Design Alert: Eliminating Buffer Overflow Vulnerabilities
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft SFI Progress Report July 2026
• Microsoft 2026 Annual Report