Microsoft Office Word: Remote code execution via use-after-free
Summary
A use-after-free flaw in Microsoft Office Word allows code execution on a victim's system. A remote attacker can exploit it by sending a specially crafted document, so the attack needs no privileges but requires the user to open the file. The CVSS base score is 8.8 (High) and CISA SSVC rates total technical impact.
Affected
- Microsoft 365 Apps for Enterprise: 16.0.1 before the build listed at aka.ms/OfficeSecurityReleases
- Microsoft Office 365 for Mac: 1.0.0 before 16.115.26110837
- Office LTSC 2021: 16.0.1 before 16.0.14334.21048
- Office LTSC 2024: 16.0.0 before a fixed version not stated in the CVE record
- Office LTSC for Mac 2021 and 2024: 16.0.0 or 16.0.1 before 16.115.26110837
Fixed in
- Office 365 for Mac and LTSC for Mac: 16.115.26110837 or later
- Office LTSC 2021: 16.0.14334.21048 or later
- Microsoft 365 Apps for Enterprise and Office LTSC 2024: fixed build unknown; check the MSRC update guide
- Per Cybersecurity News, fixes are delivered with the November 2026 Patch Tuesday updates
Workaround
Unknown.
Exploitation
- Exploit maturity in the CVE record is Unproven (E:U), so no exploitation is known to Microsoft.
- CISA SSVC: exploitation none, not automatable.
- No public proof of concept found.
- No known exploitation in the wild.
Our recommendation
- Patch Office installations to the fixed builds as a priority, via Microsoft 365 update channels, WSUS or Intune.
- Confirm installed builds against the MSRC update guide, because the fixed build for some products is not stated in the CVE record.
- Keep Protected View enabled for files from the internet and email.
- Train staff to be cautious with unsolicited Word attachments from unknown senders.
- Monitor CISA KEV for changes in exploitation status.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE.org CNA record (Microsoft) www.cve.org
- MSRC Security Update Guide msrc.microsoft.com
- Cybersecurity News: Microsoft November 2026 Patch Tuesday cybersecuritynews.com
- Strix: CVE-2026-110047 (third-party, version data unverified) www.strix.ai
- NewsBeep: severity listing www.newsbeep.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:47.
Original description (NVD)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.