Brief Summary: Microsoft Word CVE-2026-123394 Heap-Based Buffer Overflow Leading to Remote Code Execution

Introduction

One crafted document, opened by one user, is all Microsoft says is needed to turn a parsing flaw in Word into remote code execution. Microsoft fixed this heap-based buffer overflow in the November 10, 2026 Patch Tuesday release. The affected code ships across Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, so remediation is largely an exercise in verifying builds across several servicing channels.

The main facts from the Microsoft advisory:

• Severity: Important, CVSS 3.1 base score 8.8, temporal score 7.7
• Weaknesses: CWE 122 (heap-based buffer overflow) and CWE 191 (integer underflow)
• Trigger: a user opens a specially crafted file. The Preview Pane is not an attack vector.
• Status at publication: not publicly disclosed, not exploited, exploitation rated Less Likely
• Fix: official fix available in the November 2026 cumulative Office builds

Technical information

Weakness classification

Microsoft maps CVE-2026-123394 to two CWE entries. MITRE describes CWE 122 as writing past the end of a buffer allocated on the heap, and CWE 191 as a subtraction whose result falls below the minimum allowable integer value. These labels describe weakness types. They do not disclose the vulnerable Word code path. Word is closed source, and Microsoft has not published a diff, the affected function, or the parser component involved.

How this CWE pair typically combines

In file parsers, an integer underflow and a heap overflow frequently appear as cause and effect. The general pattern looks like this:

1. The parser reads a size or length value from the document.
2. That value is reduced by a subtraction, for example a header size or an offset.
3. The attacker supplies a value smaller than what is subtracted, so the unsigned result wraps around to a very large number.
4. That wrapped number drives a copy or write into a heap buffer that was allocated using a different, smaller size.
5. Memory adjacent to the buffer is overwritten.

The usual fix for this pattern is to validate the operands before the arithmetic, reject the record when the subtraction would wrap, and check the resulting length against the size of the destination buffer. This describes the general pattern for the CWE 191 plus CWE 122 combination. None of it is confirmed Word internals.

CVSS vector breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• AV:N, AC:L: network reachable with low attack complexity
• PR:N, UI:R: no attacker privileges, but a user must take an action (opening the file)
• S:U; C:H, I:H, A:H: unchanged scope with high impact to confidentiality, integrity, and availability
• E:U: exploit code maturity Unproven
• RL:O: remediation level Official Fix, meaning a complete vendor solution exists
• RC:C: report confidence Confirmed

The high base score already accounts for the required user action, which the vector records as UI:R. The NVD record was still awaiting enrichment at the time of review and showed no NIST score, so the 8.8 and 7.7 figures come from Microsoft.

Attack flow

Based on the advisory, exploitation proceeds as follows:

1. The attacker prepares a specially crafted file containing malformed data that reaches the vulnerable Word code.
2. The attacker gets the file to a target user. Microsoft does not specify a delivery method or file format, so we will not speculate on either.
3. The user opens the file in an affected Word build. Previewing it in the Preview Pane does not trigger the flaw.
4. Word processes the malformed data, the heap-based buffer overflow occurs, and Microsoft states the result can be code execution by an unauthorized attacker.

What is not established

The reviewed records do not identify:

• the exact defect in Word
• affected processor architectures beyond the 32 bit and 64 bit product rows
• any alternative workaround
• public proof of concept details
• any associated threat actor or campaign

Exploitation status

Microsoft marked the issue as not publicly disclosed and not exploited at publication. A threat tracking report dated November 10, 2026 found no public exploit code indexed in Metasploit or Exploit DB, no listing in the CISA Known Exploited Vulnerabilities catalog, no reports of in-the-wild exploitation, and no attack traffic in its sensors. These are time-bound negative observations. They do not guarantee that activity has not gone undetected.

Patch information

Microsoft fixed CVE-2026-123394 in its November 10, 2026 Patch Tuesday release for Microsoft Office. The advisory lists six Security Update rows, all released November 10, 2026, each linking to the Office security update release notes. The RL:O element of the vector confirms an official fix exists.

Fixed builds for LTSC products

MSRC and the CNA affected version data in NVD give the same boundaries. Any build below these is vulnerable:

• Microsoft Office LTSC 2021 (32 bit and 64 bit): vulnerable from 16.0.1 up to, but not including, 16.0.14334.21048. First fixed build: 16.0.14334.21048 (Version 2108).
• Microsoft Office LTSC 2024 (32 bit and 64 bit): vulnerable from 16.0.0 up to, but not including, 16.0.17932.21140. First fixed build: 16.0.17932.21140 (Version 2408).

Fixed builds for Microsoft 365 Apps and Retail

Microsoft 365 Apps is a Click to Run product that ships on several servicing channels, so MSRC points to the Office security release notes rather than a single build. Those notes list CVE-2026-123394 under the Word heading for November 10, 2026:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office 2024 and Office 2021 Retail: Version 2610 (Build 20527.20196)
• Office LTSC 2024 Volume Licensed: Version 2408 (Build 17932.21140)
• Office LTSC 2021 Volume Licensed: Version 2108 (Build 14334.21048)

Build progression

The October 13, 2026 release had LTSC 2024 at Build 17932.21056 and LTSC 2021 at Build 14334.20974. The LTSC lines stay on the same major branch (2408 and 2108), and the fix arrives as a higher minor build number. A cumulative monthly update is sufficient. No version upgrade is required.

How the patch ships

There is no standalone hotfix or source patch for this CVE. The fix is delivered only inside the cumulative November 2026 Office build for each channel:

• Click to Run installs (Microsoft 365 Apps, Retail, and Volume Licensed LTSC) receive it through normal Office updates.
• Each MSRC row also links a Security Update download.
• Any channel build at or above the listed number includes the fix.

For organizations that manage Microsoft 365 Apps centrally, Microsoft Learn describes configuring the update location with the Office Deployment Tool or Group Policy, or deploying a specific updated version through the Office Deployment Tool to control what users receive and when. Microsoft does not document a separate workaround for systems that cannot be updated.

To confirm a machine is patched, compare the installed Office build number with the fixed build for its channel listed above.

Affected systems and versions

• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): affected from version 16.0.1 up to the November 2026 channel builds listed above
• Microsoft Office LTSC 2021 (32 bit and 64 bit): versions 16.0.1 up to, but not including, 16.0.14334.21048
• Microsoft Office LTSC 2024 (32 bit and 64 bit): versions 16.0.0 up to, but not including, 16.0.17932.21140

The vulnerable configuration is any of these products on a build below the fixed version for its channel, where a user opens an attacker-supplied file in Word.

Vendor security history

The briefing materials include one relevant historical case that is separate from this CVE. The Cyber Safety Review Board's review of the Summer 2023 Microsoft Exchange Online intrusion attributed the incident to an actor assessed as associated with the government of the People's Republic of China. The Board concluded the intrusion should not have happened and identified a cascade of Microsoft security failures, including failures in detecting compromise and in security governance and culture. That was an Exchange Online incident, and nothing in the sources links it to Word or CVE-2026-123394.

Microsoft's July 2026 Secure Future Initiative progress report describes subsequent work, including reported phishing-resistant MFA coverage of 99.97%, removal of public access from 732,000 resources, and remediation of more than 550,000 critical- and high-risk open source vulnerability instances. These figures are vendor reported and have not been independently verified.

References

• Microsoft Security Update Guide: CVE-2026-123394
• NVD entry for CVE-2026-123394
• CVE Program record for CVE-2026-123394
• Microsoft 365 Apps security update release notes
• Microsoft Learn: Choose how to manage updates to Microsoft 365 Apps
• MITRE CWE 122: Heap based Buffer Overflow
• MITRE CWE 191: Integer Underflow
• Threat Radar tracking report for CVE-2026-123394
• Zero Day Initiative: The November 2026 Security Update Review
• CISA Known Exploited Vulnerabilities Catalog
• Cyber Safety Review Board: Review of the Summer 2023 Microsoft Exchange Online Intrusion
• DHS announcement of the CSRB report
• Microsoft Secure Future Initiative progress report, July 2026
• Microsoft 365 vs Office 365 enterprise comparison