Microsoft Office Word: Remote code execution vulnerability
Summary
A heap-based buffer overflow in Microsoft Word, part of Microsoft 365 Apps and Office LTSC editions, allows an attacker to execute code. Exploitation requires local access and user interaction, typically by opening a crafted document received by email or download. The CNA scores it 7.8 (High) with high impact on confidentiality, integrity and availability.
Affected
- Microsoft 365 Apps for Enterprise: 16.0.1 before the build listed on aka.ms/OfficeSecurityReleases
- Office 365 for Mac: 1.0.0 before 16.115.26110837
- Office LTSC 2021: 16.0.1 before 16.0.14334.21048
- Office LTSC 2024: 16.0.0 before a build not confirmed in the official record
- Office LTSC for Mac 2021 and 2024: versions before 16.115.26110837
Fixed in
- Office LTSC 2021: 16.0.14334.21048
- Office 365 for Mac and Office LTSC for Mac: 16.115.26110837
- Microsoft 365 Apps for Enterprise and Office LTSC 2024: Unknown. Check the MSRC advisory. A third-party site lists 16.0.17932.21140 for LTSC 2024, which is unverified.
Workaround
Unknown. No workaround is documented in the sources. Install the security update.
Exploitation
- Exploited in the wild: no evidence found.
- Microsoft exploit maturity: Unproven (E:U).
- Public proof of concept: none found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- VulDB rates it 4.8 (Medium); the CNA score 7.8 is used here.
Our recommendation
- Install the Office security update for all affected editions in the normal update cycle, sooner if email attachments are a main route into your office.
- Verify installed build numbers against the MSRC advisory.
- Check whether Microsoft 365 updates are managed centrally to speed up rollout.
- Keep Protected View enabled and restrict macros.
- Monitor the CISA KEV catalog for a later listing.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-111302 msrc.microsoft.com
- CVE Record: CVE-2026-111302 www.cve.org
- VulDB: CVE-2026-111302 vuldb.com
- Strix: CVE-2026-111302 (third-party, unverified) www.strix.ai
- Tenable: Microsoft November 2026 Patch Tuesday www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:23.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.