Microsoft Office Word: Information disclosure through out-of-bounds read
Summary
A out-of-bounds read in Microsoft Word allows an attacker to read small portions of heap memory, which can disclose information. The attacker needs local access and must get the user to open a crafted document, as the sources do not describe the user action in detail. The impact is limited to confidentiality, with no code execution.
Affected
- Microsoft 365 Apps for Enterprise (from 16.0.1, before the fix on Microsoft's security release page)
- Office 365 for Mac (from 1.0.0 before 16.115.26110837)
- Office LTSC 2021 (from 16.0.1)
- Office LTSC 2024 (from 16.0.0)
- Office LTSC for Mac 2021 and 2024 (from 16.0.0 / 16.0.1 before 16.115.26110837)
Fixed in
- Microsoft 365 Apps for Enterprise: Unknown from the verified sources; see the Microsoft Update Guide. Fix listed in the November 2026 security update.
- Office 365 for Mac: 16.115.26110837
- Unverified third-party data (Strix): Office LTSC 2021 16.0.14334.21048, Office LTSC 2024 16.0.17932.21140, LTSC for Mac 2021/2024 16.115.26110837
Workaround
Unknown. No vendor-published workaround was found.
- Interim measure (not vendor-sourced): avoid opening Word documents from untrusted sources and keep Protected View enabled for internet-sourced files.
Exploitation
- Not known to be exploited in the wild (CISA SSVC: Exploitation none).
- No public proof of concept found.
- Rapid7 rates it Exploitation Less Likely.
Our recommendation
- Install the Microsoft Office security update from November 2026 through the normal patch cycle.
- Verify exact fixed builds in the Microsoft Update Guide.
- Prioritise the higher-severity Word RCE CVEs published the same day, such as CVE-2026-112722 and CVE-2026-112723.
- Until patched, avoid opening documents from untrusted sources.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center: CVE-2026-112720 msrc.microsoft.com
- CVE Record CVE-2026-112720 www.cve.org
- Microsoft 365 Apps security updates learn.microsoft.com
- Rapid7: Patch Tuesday November 2026 www.rapid7.com
- Strix: CVE-2026-112720 (unverified) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:55.
Original description (NVD)
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.