Microsoft Word: Heap-based buffer overflow leading to code execution
Summary
A heap-based buffer overflow in Microsoft Word, shipped with Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and Office for Mac, allows code execution. The CVSS vector is local (AV:L) and requires no privileges but user interaction, so an attacker typically needs a user to open a malicious document. Successful exploitation would fully compromise confidentiality, integrity and availability (CVSS 7.8 High). NVD analysis is still pending, and the sources disagree on the attack vector.
Affected
- Microsoft 365 Apps for Enterprise: 16.0.1 before the fixed build (build number not stated in the CNA record)
- Office for Mac and Office 365 for Mac: 1.0.0 before 16.115.26110837
- Office LTSC 2021: 16.0.1 before 16.0.14334.21048
- Office LTSC 2024: listed as affected, range start 16.0.0 (fixed build not confirmed)
- Office LTSC for Mac 2021 and 2024: 16.0.1 and 16.0.0 before 16.115.26110837
Fixed in
- Office for Mac: 16.115.26110837 or later (per CNA record)
- Office LTSC 2021: 16.0.14334.21048 or later (per CNA record)
- Microsoft 365 Apps for Enterprise: fixed build not stated; see MSRC
- Office LTSC 2024: fixed build unconfirmed; check MSRC
Workaround
Unknown. No vendor-published workaround was found. Check the 'Mitigations' and 'Workarounds' sections of the MSRC advisory.
Exploitation
- No reports of in-the-wild exploitation or public proof-of-concept code were found. This is not a confirmed absence.
- The CNA record marks exploit code maturity as Unproven (E:U).
- The November 2026 release has one actively exploited flaw, an Outlook spoofing bug, which is not this CVE.
Our recommendation
- Patch all Office clients (Microsoft 365 Apps, LTSC 2021/2024, Office for Mac) promptly, using the builds listed on MSRC.
- Verify the affected builds and fixes on MSRC before relying on the version numbers above.
- Restrict or sandbox untrusted Word attachments and downloads, and consider blocking Word files from the internet where feasible.
- Monitor for suspicious Office process activity after opening documents.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide (CVE-2026-110049) msrc.microsoft.com
- CVE.org record CVE-2026-110049 www.cve.org
- CVEProject cvelistV5 release github.com
- Action1: Patch Tuesday November 2026 www.action1.com
- CrowdStrike: Patch Tuesday analysis November 2026 www.crowdstrike.com
- NT Compatible: Microsoft November 2026 Patch Tuesday www.ntcompatible.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:24.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.