Microsoft Office Word: Remote code execution via crafted file

Summary

A use of uninitialized resource in Microsoft Office Word allows an attacker to execute code on the affected system over the network. The attacker must send the user a malicious Office file and convince the user to open it, so email attachments and downloaded documents are the main risk. Code runs with the rights of the user, and successful exploitation depends on the environment, system configuration and other security measures. Microsoft rates the vulnerability as Critical, while the CVSS 3.1 base score is 7.5 (High).

Affected

• Microsoft 365 Apps for Enterprise: 16.0.1 before the fixed build listed at https://aka.ms/OfficeSecurityReleases
• Microsoft Office LTSC 2021: 16.0.1 before 16.0.14334.21048
• Microsoft Office LTSC 2024: 16.0.0 before 16.0.17932.21140
• Office 2019, Office 2016 and Mac builds: Unknown.

Fixed in

• Microsoft 365 Apps for Enterprise: Fixed build not confirmed in the sources; check the MSRC advisory.
• Microsoft Office LTSC 2021: 16.0.14334.21048 and later
• Microsoft Office LTSC 2024: 16.0.17932.21140 and later
• Fix released on November 10, 2026 (Patch Tuesday).

Workaround

Unknown. No vendor workaround was found in the sources. Check the MSRC advisory for mitigations.

• Interim measure: keep Protected View and macros enabled only for trusted files, and block or quarantine Office attachments from untrusted senders.

Exploitation

• Action1 states the vulnerability is not known to be exploited in the wild and was not publicly disclosed before the fix.
• Talos lists this CVE among four Word CVEs in a month with one exploited vulnerability, without naming it. Exploited status is unconfirmed.
• CISA KEV: Not confirmed by direct check.
• CISA SSVC: Exploitation none, automatable no, technical impact total.

Our recommendation

• Patch all affected Office LTSC and Microsoft 365 Apps installations on Patch Tuesday day; for Microsoft 365 Apps, verify the fixed build in the MSRC advisory.
• Until patched, block or quarantine Office attachments from untrusted senders and keep Protected View active for files from outside the organisation.
• Check the MSRC advisory for the "Exploited" field and any mitigations.
• Limit local admin rights and file share access to reduce the impact of code execution.
• Monitor for suspicious Word process activity and unexpected child processes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-124185 msrc.microsoft.com
• CVE Record CVE-2026-124185 www.cve.org
• Action1: Patch Tuesday November 2026 www.action1.com
• Talos: Microsoft Patch Tuesday for November 2026 blog.talosintelligence.com
• Strix: CVE-2026-124185 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:15.