{"id":"CVE-2026-110049","kind":"vulnerability","aliases":["CVE-2026-110049"],"related":[],"title":"Microsoft Word: heap buffer overflow lets a local attacker run code","description":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.","summary":"A heap-based buffer overflow in Microsoft Office Word lets an unauthorized attacker run code on the machine where Word runs. The attack is local, so the attacker needs access to the machine or a way to get a user to open a crafted file.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["microsoft-office","other","windows","word"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:21+00:00","first_seen_at":"2026-11-10T19:24:26+00:00","triaged_at":"2026-11-10T19:42:23+00:00","updated_at":"2026-11-10T19:42:23+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T19:42:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Microsoft Word: heap buffer overflow lets a local attacker run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft Office Word lets an unauthorized attacker run code on the machine where Word runs. The attack is local, so the attacker needs access to the machine or a way to get a user to open a crafted file.","audience":"businesses","category":"other","nicknames":[],"who_cares":["microsoft-office","word","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Code runs on the user's machine with their privileges.","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-110049 for affected builds, patch KB and whether a crafted file is needed.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Microsoft Office Word on Windows machines are exposed. Sources do not state affected builds or whether opening a crafted document is enough to trigger the flaw.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000663,"input_tokens":4492,"output_tokens":428,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-110049 for affected builds, patch KB and whether a crafted file is needed.","search":"'-110049':14A,17A '-2026':13A,16A 'access':54B 'allow':79C 'attack':9A,37B,47B,52B,82C 'base':27B,72C 'buffer':4A,28B,73C 'code':11A,39B,85C 'craft':68B 'cve':12A,15A 'execut':84C 'file':69B 'get':62B 'heap':3A,26B,71C 'heap-bas':25B,70C 'let':6A,34B 'local':8A,49B,86C 'machin':42B,57B 'microsoft':1A,19B,31B,76C 'microsoft-offic':18B 'need':53B 'offic':20B,32B,77C 'open':66B 'overflow':5A,29B,74C 'run':10A,38B,45B 'unauthor':36B,81C 'user':64B 'way':60B 'window':22B 'word':2A,23B,33B,44B,78C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Microsoft Office Word on Windows machines are exposed. Sources do not state affected builds or whether opening a crafted document is enough to trigger the flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","microsoftoffice","other","windows","word"],"campaign_type":null,"search_a":"'-110049':14A,17A '-2026':13A,16A 'attack':9A 'buffer':4A 'code':11A 'cve':12A,15A 'heap':3A 'let':6A 'local':8A 'microsoft':1A 'overflow':5A 'run':10A 'word':2A","search_b":"'access':54B 'attack':37B,47B,52B 'base':27B 'buffer':28B 'code':39B 'craft':68B 'file':69B 'get':62B 'heap':26B 'heap-bas':25B 'let':34B 'local':49B 'machin':42B,57B 'microsoft':19B,31B 'microsoft-offic':18B 'need':53B 'offic':20B,32B 'open':66B 'overflow':29B 'run':38B,45B 'unauthor':36B 'user':64B 'way':60B 'window':22B 'word':23B,33B,44B","search_c":"'allow':79C 'attack':82C 'base':72C 'buffer':73C 'code':85C 'execut':84C 'heap':71C 'heap-bas':70C 'local':86C 'microsoft':76C 'offic':77C 'overflow':74C 'unauthor':81C 'word':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110049","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110049","severity":null,"published_at":"2026-11-10T19:18:21+00:00","modified_at":"2026-11-10T19:18:22+00:00","first_seen_at":"2026-11-10T19:24:26+00:00","fetched_at":"2026-11-10T19:24:26+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}