Microsoft Office Word: Heap-based buffer overflow allows remote code execution
Summary
A heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. No privileges are required, but the victim must open a crafted document, for example one delivered by phishing email or as a malicious attachment. Successful exploitation would give the attacker code execution in the user's context, with high impact on confidentiality, integrity and availability.
Affected
- Microsoft 365 Apps for Enterprise: 16.0.1 up to the fixed build (see MSRC)
- Office LTSC 2021: 16.0.1 up to 16.0.14334.21048 (excluding)
- Office LTSC 2024: 16.0.0 up to 16.0.17932.21140 (excluding)
- Office 365 for Mac: 1.0.0 up to 16.115.26110837 (excluding)
- Office LTSC for Mac 2021: 16.0.1 up to 16.115.26110837 (excluding)
- Office LTSC for Mac 2024: 16.0.0 up to 16.115.26110837 (excluding)
Fixed in
- Microsoft 365 Apps for Enterprise: Unknown, check MSRC
- Office LTSC 2021: 16.0.14334.21048
- Office LTSC 2024: 16.0.17932.21140
- Office 365 for Mac and Office LTSC for Mac: 16.115.26110837
- Verify all builds on MSRC before rollout
Workaround
Unknown. No vendor workaround was found.
- Until patched, restrict or sandbox untrusted Office files from email and downloads.
- Keep Microsoft 365 automatic updates enabled.
- This is general hardening advice, not a documented mitigation for this CVE.
Exploitation
- No exploitation in the wild known at publication.
- No public proof of concept found.
- Not found in the CISA KEV catalogue in our search; the catalogue was not checked directly.
- CVSS temporal metrics (E:U) indicate no known exploit code at publication.
Our recommendation
- Confirm the fixed builds for each channel on MSRC and apply the update to all Microsoft 365, LTSC and Mac installations.
- Prioritise Mac and LTSC installations, which usually need manual or managed updates.
- Inventory Office versions in your environment and verify they are patched.
- Restrict untrusted attachments and monitor for KEV or proof-of-concept updates, as NVD status was still Awaiting Analysis.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide (MSRC) msrc.microsoft.com
- CVE.org record CVE-2026-112741 www.cve.org
- Strix mirror CVE-2026-112741 www.strix.ai
- Qualys Patch Tuesday review November 2026 blog.qualys.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 22:52.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.