{"id":"CVE-2026-110056","kind":"vulnerability","aliases":["CVE-2026-110056"],"related":[],"title":"Microsoft Word: heap overflow lets a local attacker run code","description":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.","summary":"A heap-based buffer overflow in Microsoft Office Word lets an attacker who can run code locally execute code. The description does not say how a victim would be tricked into opening a crafted file.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Office Word","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["microsoft-office","other","windows","word"],"not_affected_if":[],"how_to_check":"- Check the installed Word version under File > Account > About Word in Microsoft Word.","fix":null,"status":"open","published_at":"2026-11-10T19:18:23+00:00","first_seen_at":"2026-11-10T19:24:27+00:00","triaged_at":"2026-11-10T19:42:23+00:00","updated_at":"2026-11-10T19:42:23+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T19:42:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Microsoft Word: heap overflow lets a local attacker run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft Office Word lets an attacker who can run code locally execute code. The description does not say how a victim would be tricked into opening a crafted file.","audience":"businesses","category":"other","nicknames":[],"who_cares":["microsoft-office","word","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs code on the local machine with the user's rights","analyst_note":"Confirm affected Word builds, fixed update and whether a crafted file must be opened, via the Microsoft Security Update Guide entry for CVE-2026-110056.","how_to_check":"- Check the installed Word version under File > Account > About Word in Microsoft Word.\n- unknown for affected build ranges, as the sources do not list them.","plain_action":"","product_name":"Microsoft Office Word","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organisations that run Microsoft Office Word on Windows machines are the ones exposed. The sources do not list affected builds or say what user action triggers the flaw, so the exact exposure is unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4492,"output_tokens":496,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Confirm affected Word builds, fixed update and whether a crafted file must be opened, via the Microsoft Security Update Guide entry for CVE-2026-110056.","search":"'-110056':13A,16A '-2026':12A,15A 'allow':71C 'attack':8A,38B,74C 'base':29B,64C 'buffer':30B,65C 'code':10A,42B,45B,77C 'craft':60B 'cve':11A,14A 'descript':47B 'execut':44B,76C 'file':61B 'heap':3A,28B,63C 'heap-bas':27B,62C 'let':5A,36B 'local':7A,43B,78C 'microsoft':1A,17A,21B,33B,68C 'microsoft-offic':20B 'offic':22B,34B,69C 'office':18A 'open':58B 'overflow':4A,31B,66C 'run':9A,41B 'say':50B 'trick':56B 'unauthor':73C 'victim':53B 'window':24B 'word':2A,19A,25B,35B,70C 'would':54B","nicknames":[],"mitigations":[],"who_affected":"Organisations that run Microsoft Office Word on Windows machines are the ones exposed. The sources do not list affected builds or say what user action triggers the flaw, so the exact exposure is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["microsoftofficeword","officeword"],"ptokens":["microsoft","office","word"],"labels":["high","microsoftoffice","other","vendor","windows","word"],"campaign_type":null,"search_a":"'-110056':13A,16A '-2026':12A,15A 'attack':8A 'code':10A 'cve':11A,14A 'heap':3A 'let':5A 'local':7A 'microsoft':1A,17A 'office':18A 'overflow':4A 'run':9A 'word':2A,19A","search_b":"'attack':38B 'base':29B 'buffer':30B 'code':42B,45B 'craft':60B 'descript':47B 'execut':44B 'file':61B 'heap':28B 'heap-bas':27B 'let':36B 'local':43B 'microsoft':21B,33B 'microsoft-offic':20B 'offic':22B,34B 'open':58B 'overflow':31B 'run':41B 'say':50B 'trick':56B 'victim':53B 'window':24B 'word':25B,35B 'would':54B","search_c":"'allow':71C 'attack':74C 'base':64C 'buffer':65C 'code':77C 'execut':76C 'heap':63C 'heap-bas':62C 'local':78C 'microsoft':68C 'offic':69C 'overflow':66C 'unauthor':73C 'word':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110056","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110056","severity":null,"published_at":"2026-11-10T19:18:23+00:00","modified_at":"2026-11-10T19:18:23+00:00","first_seen_at":"2026-11-10T19:24:27+00:00","fetched_at":"2026-11-10T19:24:27+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}