{"id":"CVE-2026-110054","kind":"vulnerability","aliases":["CVE-2026-110054"],"related":[],"title":"Microsoft Word: heap buffer overflow lets an attacker run code remotely","description":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word (CWE-122, CVSS 8.8, user interaction required per vector UI:R) lets an attacker run code with the opening user's rights, typically via a crafted document. Microsoft's CVE record lists fixed builds; no exploitation or public PoC reported as of 2026-11-10. The MSRC page itself was not read, so the trigger (document vs. Preview Pane) is unconfirmed.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Office LTSC 2021","fixed":["16.0.14334.21048"],"affected":"< 16.0.14334.21048","ecosystem":"vendor"},{"name":"Office LTSC 2024","fixed":["16.0.17932.21140"],"affected":"< 16.0.17932.21140","ecosystem":"vendor"},{"name":"Office for Mac (365 and LTSC 2021/2024)","fixed":["16.115.26110837"],"affected":"< 16.115.26110837","ecosystem":"vendor"},{"name":"Microsoft 365 Apps for Enterprise","fixed":[],"affected":">= 16.0.1, fixed build see aka.ms/OfficeSecurityReleases","ecosystem":"vendor"}],"ecosystems":[],"tags":["macos","microsoft-office","other","user-interaction","windows","word"],"not_affected_if":["patched-build"],"how_to_check":"In Word: File > Account > About Word and compare the build to the fixed builds. Fixed builds per the CVE record: Office LTSC 2021 16.0.14334.21048; Office LTSC 2024 16.0.17932.21140; Office/LTSC for Mac 16.115.26110837. For Microsoft 365 Apps, see aka.ms/OfficeSecurityReleases for the November 2026 build.","fix":"Update to Office LTSC 2021 16.0.14334.21048, LTSC 2024 16.0.17932.21140, Mac 16.115.26110837 or later; Microsoft 365 Apps: latest build per aka.ms/OfficeSecurityReleases.","status":"open","published_at":"2026-11-10T19:18:22+00:00","first_seen_at":"2026-11-10T19:24:27+00:00","triaged_at":"2026-11-10T19:32:33+00:00","updated_at":"2026-11-11T00:35:34+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T19:32:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Word: heap buffer overflow lets an attacker run code remotely","impact":"high","summary":"A heap-based buffer overflow in Microsoft Office Word lets an unauthorized attacker run code over a network. The sources do not describe the trigger, the affected Word versions, or a fix.","audience":"everyone","category":"other","nicknames":[],"who_cares":["microsoft-office","word","windows"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the victim's machine over the network.","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-110054 for affected versions, fixed builds, and whether a document or preview trigger is required.","how_to_check":"- unknown","plain_action":"Update Microsoft Word through Microsoft Update once Microsoft releases a fix for this flaw.","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations and people running Microsoft Office Word. The sources do not name the affected versions or the exact trigger, so whether a given install is exposed is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000677,"input_tokens":4494,"output_tokens":455,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-110054 for affected versions, fixed builds, and whether a document or preview trigger is required.","search":"'-10':99B '-11':98B '-110054':14A,17A '-122':56B '-2026':13A,16A '2021':20A '2021/2024':30A '2024':23A '2026':97B '365':27A,32A '8.8':58B 'allow':125C 'and':28A 'apps':33A 'attack':8A,68B,128C 'base':48B,118C 'buffer':4A,49B,119C 'build':88B 'code':10A,70B,131C 'craft':80B 'cve':12A,15A,84B 'cvss':57B 'cwe':55B 'document':81B,110B 'enterprise':35A 'execut':130C 'exploit':90B 'fix':87B 'for':25A,34A 'heap':3A,47B,117C 'heap-bas':46B,116C 'interact':43B,60B 'let':6A,66B 'list':86B 'ltsc':19A,22A,29A 'mac':26A 'maco':36B 'microsoft':1A,31A,38B,52B,82B,122C 'microsoft-offic':37B 'msrc':101B 'network':134C 'offic':39B,53B,123C 'office':18A,21A,24A 'open':73B 'overflow':5A,50B,120C 'page':102B 'pane':113B 'per':62B 'poc':93B 'preview':112B 'public':92B 'r':65B 'read':106B 'record':85B 'remot':11A 'report':94B 'requir':61B 'right':76B 'run':9A,69B 'trigger':109B 'typic':77B 'ui':64B 'unauthor':127C 'unconfirm':115B 'user':42B,59B,74B 'user-interact':41B 'vector':63B 'via':78B 'vs':111B 'window':44B 'word':2A,45B,54B,124C","nicknames":[],"mitigations":[],"who_affected":"Organizations and people running Microsoft Office Word. The sources do not name the affected versions or the exact trigger, so whether a given install is exposed is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":"Update Microsoft Word through Microsoft Update once Microsoft releases a fix for this flaw.","pkeys":["365appsforenterprise","formac365andltsc20212024","ltsc2021","ltsc2024","microsoft365appsforenterprise","officeformac365andltsc20212024","officeltsc2021","officeltsc2024"],"ptokens":["2021","2024","365","and","apps","enterprise","for","ltsc","mac","microsoft","office"],"labels":["high","macos","microsoftoffice","other","userinteraction","windows","word"],"campaign_type":null,"search_a":"'-110054':14A,17A '-2026':13A,16A '2021':20A '2021/2024':30A '2024':23A '365':27A,32A 'and':28A 'apps':33A 'attack':8A 'buffer':4A 'code':10A 'cve':12A,15A 'enterprise':35A 'for':25A,34A 'heap':3A 'let':6A 'ltsc':19A,22A,29A 'mac':26A 'microsoft':1A,31A 'office':18A,21A,24A 'overflow':5A 'remot':11A 'run':9A 'word':2A","search_b":"'-10':99B '-11':98B '-122':56B '2026':97B '8.8':58B 'attack':68B 'base':48B 'buffer':49B 'build':88B 'code':70B 'craft':80B 'cve':84B 'cvss':57B 'cwe':55B 'document':81B,110B 'exploit':90B 'fix':87B 'heap':47B 'heap-bas':46B 'interact':43B,60B 'let':66B 'list':86B 'maco':36B 'microsoft':38B,52B,82B 'microsoft-offic':37B 'msrc':101B 'offic':39B,53B 'open':73B 'overflow':50B 'page':102B 'pane':113B 'per':62B 'poc':93B 'preview':112B 'public':92B 'r':65B 'read':106B 'record':85B 'report':94B 'requir':61B 'right':76B 'run':69B 'trigger':109B 'typic':77B 'ui':64B 'unconfirm':115B 'user':42B,59B,74B 'user-interact':41B 'vector':63B 'via':78B 'vs':111B 'window':44B 'word':45B,54B","search_c":"'allow':125C 'attack':128C 'base':118C 'buffer':119C 'code':131C 'execut':130C 'heap':117C 'heap-bas':116C 'microsoft':122C 'network':134C 'offic':123C 'overflow':120C 'unauthor':127C 'word':124C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110054","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110054","severity":null,"published_at":"2026-11-10T19:18:22+00:00","modified_at":"2026-11-10T19:18:22+00:00","first_seen_at":"2026-11-10T19:24:27+00:00","fetched_at":"2026-11-10T19:24:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110054:3366","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110054","severity":null,"published_at":"2026-11-11T00:35:34+00:00","modified_at":"2026-11-11T00:35:34+00:00","first_seen_at":"2026-11-11T00:35:34+00:00","fetched_at":"2026-11-11T00:35:34+00:00","note":"MSRC page not retrievable; used Microsoft CNA data via NVD/OpenCVE. Nothing verified. No exploitation reported, not in KEV.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-110054","https://app.opencve.io/cve/CVE-2026-110054"]}],"documents":[{"id":120893,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110054","title":"NVD CVE-2026-110054 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":120895,"url":"https://app.opencve.io/cve/CVE-2026-110054","title":"OpenCVE CVE-2026-110054 (CNA product list)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}