IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft Office Word: Remote code execution via heap-based buffer overflow

CVE-2026-110064High 8.8

← All vulnerabilities

Summary

A heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. The CVSS vector requires no privileges and low complexity, but user interaction (UI:R), typically opening a crafted document, is needed. The impact is rated high for confidentiality, integrity and availability.

Affected

  • Microsoft 365 Apps for Enterprise: 16.0.1 up to the fixed build (exact build unknown, see MSRC)
  • Microsoft Office 365 for Mac: 1.0.0 to before 16.115.26110837
  • Microsoft Office LTSC 2021: 16.0.1 to before 16.0.14334.21048
  • Microsoft Office LTSC 2024: 16.0.0 to before 16.0.17932.21140 (secondary source, unverified)
  • Microsoft Office LTSC for Mac 2021 and 2024: 16.0.1 to before 16.115.26110837 (secondary source, unverified)

Fixed in

  • Microsoft 365 Apps for Enterprise: November 2026 security update (exact build unknown, see MSRC)
  • Microsoft Office 365 for Mac: 16.115.26110837 or later
  • Microsoft Office LTSC 2021: 16.0.14334.21048 or later
  • Microsoft Office LTSC 2024: 16.0.17932.21140 or later (unverified, confirm with Microsoft)
  • Microsoft Office LTSC for Mac 2021 and 2024: 16.115.26110837 or later (unverified, confirm with Microsoft)
  • Released on November 10, 2026 as part of the November 2026 Patch Tuesday

Workaround

Unknown. No vendor-published workaround was found. Check the MSRC advisory.

  • Until patched, keep Protected View enabled.
  • Block macros from the internet.

Exploitation

  • Not known to be exploited in the wild for this CVE.
  • Not listed in CISA KEV as far as found.
  • CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
  • No public proof of concept found (search gap, not proof of absence).
  • The Outlook flaw CVE-2026-124194 in the same release is reported as exploited; it is a different vulnerability.

Our recommendation

  • Install the November 2026 Office security updates in the normal monthly patch cycle with high priority.
  • Check which Office builds are in use and whether they are below the fixed versions above.
  • Keep Protected View enabled and block macros from the internet.
  • Train users to be cautious with unsolicited Word attachments and documents from the web.
  • Reassess the priority if exploitation is reported or CISA adds the CVE to KEV.

Information from Microsoft (Patch Tuesday November 2026)

Severity (Microsoft)
Important
Impact
Remote code execution – Microsoft Office Word
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Microsoft Office

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:42.

Original description (NVD)

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed