Microsoft Office Word: Remote code execution via heap-based buffer overflow
Summary
A heap-based buffer overflow in Microsoft Office Word allows remote code execution. An attacker can run code on the victim's system by delivering a crafted document, for example by email attachment or download. No authentication is required, but the user must open or interact with the file.
Affected
- Microsoft 365 Apps for Enterprise (32-bit and x64): 16.0.1 before a fixed build (CNA record gives a link, no version number)
- Microsoft Office 365 for Mac: 1.0.0 before 16.115.26110837
- Microsoft Office LTSC 2021 (32-bit and x64): 16.0.1 before 16.0.14334.21048
- Microsoft Office LTSC 2024: 16.0.0 before 16.0.17932.21140 (secondary source, not verified against Microsoft)
- Microsoft Office LTSC for Mac 2021 and 2024: before 16.115.26110837 (secondary source for LTSC for Mac 2021 and 2024 entries as stated in research notes)
Fixed in
- Microsoft 365 Apps for Enterprise: Unknown (check MSRC page)
- Microsoft Office 365 for Mac: 16.115.26110837
- Microsoft Office LTSC 2021: 16.0.14334.21048
- Microsoft Office LTSC 2024: 16.0.17932.21140 (unverified)
- Microsoft Office LTSC for Mac 2021 and 2024: 16.115.26110837 (unverified)
Workaround
Unknown. No vendor-documented workaround or mitigation found in the sources checked.
Exploitation
- No known exploitation in the wild in the sources checked
- No public proof-of-concept code found
- CNA rates exploit code maturity as Unproven (E:U)
- CISA SSVC: exploitation none, automatable no, technical impact total
Our recommendation
- Patch all affected Office installations as a high priority, using the MSRC advisory and your Office update channel to confirm the build
- Verify the exact fixed build for Microsoft 365 Apps, as the CNA record gives no version number
- Until patched, block or quarantine Office documents from untrusted senders and restrict macros and file-format handling
- Prioritise users who regularly handle external documents
- Patch the related Word and Office CVEs in the same batch (e.g. CVE-2026-112714, CVE-2026-112715, CVE-2026-112717)
- Monitor for exploitation reports, as the record is new
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide (MSRC advisory) msrc.microsoft.com
- CVE.org CNA record www.cve.org
- Strix CVE-2026-112716 (secondary, unverified) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:05.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.