Introduction
Microsoft's November 10, 2026 security release fixed a memory safety flaw in Microsoft Office Word that, according to Microsoft, allows an unauthorized attacker to execute code over a network. The fix spans subscription and LTSC Office builds on both Windows and Mac, and each product family has its own fixed build threshold, so patch verification needs more care than checking a single version number.
CVE-2026-109491 carries a Microsoft-supplied CVSS 3.1 base score of 7.5 (High) and a Microsoft severity rating of Important. The advisory sets a high-impact outcome (code execution with high confidentiality, integrity, and availability impact) against restrictive prerequisites (high attack complexity and required user interaction), and Microsoft's own assessment is Exploitation Less Likely.
Technical information
Root cause
Microsoft describes the issue in one sentence: "Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network." The weakness is classified as CWE-416, Use After Free.
MITRE defines this weakness as referencing memory after it has been freed. Once freed, that memory can be handed out to a new allocation while an older pointer still refers to it, so any operation through the stale pointer acts on memory that now belongs to something else. Depending on what lands in that memory, outcomes for this weakness class range from data corruption and crashes to information disclosure and, in suitable circumstances, arbitrary code execution.
For this CVE specifically, Microsoft confirms remote code execution as the impact. The public record says nothing about how that happens:
- No affected function, object type, or document feature is named.
- No file format, attachment type, or delivery channel is described.
- No memory management sequence (which object is freed, which reference survives) is disclosed.
- No exploit chain explaining how execution is achieved is published.
Office is closed source, so there is no public commit or diff to examine, and we have no vulnerable code to show.
CVSS breakdown
The published base vector is:
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
| Metric | Value | Meaning |
|---|---|---|
| Attack Vector | Network | The attack is remotely reachable. |
| Attack Complexity | High | Successful exploitation depends on conditions beyond the attacker's control. |
| Privileges Required | None | The attacker needs no prior privileges. |
| User Interaction | Required | A user must take an action for exploitation to succeed. |
| Scope | Unchanged | No change of security authority is identified. |
| Confidentiality, Integrity, Availability | High | Successful exploitation has high impact across all three. |
Microsoft also publishes a temporal score of 6.5, reflecting exploit maturity Unproven, remediation level Official Fix, and report confidence Confirmed. NVD displays Microsoft's base assessment and notes that its own assessment has not yet been provided.
For prioritization, high complexity and required user interaction constrain whether exploitation succeeds. They do not reduce the impact if it does.
Attack flow, as far as the public record supports it
We can only describe the flow at the level Microsoft has disclosed, combined with how the use-after-free class generally works. The following is not a reproducible procedure:
- An unauthenticated attacker reaches the target over a network (PR:N, AV:N).
- A user must take some action for the attack to proceed (UI:R). Microsoft does not say what that action is, but it does state that the Preview Pane is not an attack vector, so merely previewing content in that pane is excluded.
- Conditions outside the attacker's control must line up for exploitation to succeed (AC:H).
- Inside Word, an object is freed while another code path still holds a pointer to it. When that stale pointer is later followed, Word reads or writes memory that an attacker may have refilled with their own data.
- If successful, the attacker executes code with high impact to confidentiality, integrity, and availability (C:H/I:H/A:H), within the unchanged scope of the Word process.
We deliberately avoid mapping this onto a specific phishing, browser, or document-parsing scenario, because the advisory does not describe one.
Threat status at publication
Microsoft's advisory reports the following:
- Exploited: No
- Publicly disclosed: No
- Exploitability assessment: Exploitation Less Likely
- Exploit maturity: Unproven
- Remediation level: Official Fix
No threat actor, campaign, infrastructure, malicious file hashes, payload family, or detection signature has been published for this CVE. The advisory credits namnp with Viettel Cyber Security for the discovery, which is a research acknowledgement, not an attribution. Microsoft does not publish a specific reason for its Exploitation Less Likely rating, and these statuses reflect the assessment at publication rather than a guarantee about future activity.
Patch information
Microsoft fixed CVE-2026-109491 in its November 10, 2026 Patch Tuesday release. The MSRC advisory sets the remediation level to Official Fix, meaning a complete vendor fix is available and no interim workaround is needed. Microsoft lists no CVE-specific workaround or compensating control.
How use-after-free fixes usually work
Fixes for this bug class normally ensure an object stays alive as long as anything references it, for example through correct reference counting or ownership. Other common approaches are clearing or invalidating pointers when the object is freed, or rechecking that an object is still valid before use. Microsoft has not said which of these it changed in Word, so treat this as background on the class rather than a description of this patch.
Fixed builds from the MSRC Security Updates table
- Microsoft Office LTSC 2024 (32 bit and 64 bit):
16.0.17932.21140 - Microsoft Office LTSC 2021 (32 bit and 64 bit):
16.0.14334.21048 - Microsoft 365 Apps for Enterprise (32 bit and 64 bit): per channel, see the Office security release notes (aka.ms/OfficeSecurityReleases)
- Microsoft Office 365 for Mac:
16.115.26110837 - Microsoft Office LTSC for Mac 2024:
16.115.26110837 - Microsoft Office LTSC for Mac 2021:
16.115.26110837
Click to Run channel builds for November 10, 2026
Microsoft's Release notes for Microsoft Office security updates page lists CVE-2026-109491 under Word for this release:
- Current Channel: Version 2610 (Build 20527.20196)
- Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
- Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
- Office 2024 Retail and Office 2021 Retail: Version 2610 (Build 20527.20196)
- Office LTSC 2024 Volume Licensed: Version 2408 (Build 17932.21140)
- Office LTSC 2021 Volume Licensed: Version 2108 (Build 14334.21048)
The Word fix ships inside the normal cumulative Click to Run update, not as a separate package. Installing the month's channel build replaces the vulnerable Word binaries. To confirm a machine is patched, check that its Office build is at or above the threshold for its channel.
Installing the update
Windows: Microsoft Support instructs users to open an Office application such as Word, create a document, and select File > Account > Update Options > Update Now. If Update Now is not available, select Enable Updates first. If an installation shows only About, without Update Options, Microsoft says it may be volume licensed or managed through Group Policy. In that case the guidance is to try Microsoft Update or contact the company help desk. In enterprises, this means the fix will typically arrive through whatever servicing mechanism manages the Office channel rather than through user self service.
Mac, installed from Microsoft: Open Word and select Help > Check for Updates, then Update. Microsoft also documents the Automatically keep Microsoft apps up to date option. If Check for Updates is missing, run the latest Microsoft AutoUpdate tool and check again.
Mac, installed from the Mac App Store: Use the App Store's Updates section and select Update All, or update the application individually. Apps update automatically when automatic updates are enabled.
Notes on scope
- The MSRC table has nine product rows for this CVE: the Mac and LTSC entries above plus the two Microsoft 365 Apps entries. Office 2019, Office Online Server, and SharePoint are not among them, even though separate November KBs exist for those products.
- When the Office for Mac release notes page was fetched, it was a copy cached before the release and did not yet mention this CVE. The Mac fixed build
16.115.26110837comes from the MSRC advisory and NVD. - Microsoft gives no CVE-specific technical detail on the fix beyond the CWE-416 classification.
Affected systems and versions
NVD's affected version ranges, taken from Microsoft's CNA data, match the MSRC table. Every version below the listed fixed build is vulnerable:
- Microsoft Office LTSC 2024 for Windows (32 bit and 64 bit editions): versions below
16.0.17932.21140 - Microsoft Office LTSC 2021 for Windows (32 bit and 64 bit editions): versions below
16.0.14334.21048 - Microsoft Office 365 for Mac: versions below
16.115.26110837 - Microsoft Office LTSC for Mac 2024: versions below
16.115.26110837 - Microsoft Office LTSC for Mac 2021: versions below
16.115.26110837 - Microsoft 365 Apps for Enterprise (32 bit and 64 bit systems): builds below the November 10, 2026 threshold for the installed channel (Current Channel below Build 20527.20196; Monthly Enterprise Channel below Builds 20527.20194, 20430.20264, or 20326.20320 for Versions 2610, 2609, and 2608 respectively; Semi Annual Enterprise Channel below Builds 20527.20192, 20430.20262, or 20326.20318 for Versions 2610, 2609, and 2608 respectively)
- Office 2024 Retail and Office 2021 Retail: below Version 2610 (Build 20527.20196)
The Mac products share a single fixed build, while Windows LTSC 2021 and LTSC 2024 have different thresholds and Microsoft 365 Apps varies by channel. A single version check across a mixed fleet will produce wrong answers.
Vendor security history
Office documents have been used in real attacks before. Microsoft's account of Storm-0978 describes a June 2023 campaign against defense and government organizations using phishing material and Word documents associated with CVE-2023-36884, delivering a backdoor similar to RomCom in what Microsoft assessed as likely espionage-driven activity. CISA added CVE-2023-36884 to its Known Exploited Vulnerabilities Catalog on July 17, 2023, and Microsoft released security updates for it on August 8, 2023.
That case is useful context for why Word vulnerabilities warrant attention, but it is not evidence that Storm-0978 or anyone else is exploiting CVE-2026-109491. The historical case had a named actor, a described delivery method, and independent confirmation of exploitation. The current CVE has none of those.
On the process side, Microsoft's July 2026 Secure Future Initiative report describes embedding security into governance and engineering, including broadly enforcing Zero Trust for source code access and using centrally governed templates in 93% of critical and high-value build pipelines. These are Microsoft-reported program outcomes, not independent measurements of Word's resistance to exploitation. CVE-2026-109491 itself went through coordinated vulnerability disclosure, with credit to namnp with Viettel Cyber Security.
References
- NVD: CVE-2026-109491
- Microsoft Security Update Guide: CVE-2026-109491, Microsoft Office Word Remote Code Execution Vulnerability
- Microsoft Learn: Release notes for Microsoft Office security updates
- Microsoft Learn: Release notes for Office for Mac
- MITRE CWE-416: Use After Free
- CISA: CISA Adds One Known Exploited Vulnerability to Catalog (July 17, 2023)
- Microsoft Security Blog: Storm-0978 attacks reveal financial and espionage motives
- Microsoft Trust Center: SFI Progress Report July 2026
- Microsoft 365 Apps for business
- Microsoft Support: How to update Microsoft 365 or Office for Windows
- Microsoft Support: Update Office for Mac automatically
