{"id":"CVE-2026-110061","kind":"vulnerability","aliases":["CVE-2026-110061"],"related":[],"title":"Microsoft Word: crafted document can run code when opened (heap buffer overflow)","description":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word (CWE-122). Microsoft rates it CVSS 8.8 (AV:N/AC:L/PR:N/UI:R): the attacker must get a user to open a crafted file, delivered over the network (email, chat, download). Code runs as the current user. CISA SSVC (Nov 10 2026): exploitation none, not automatable. Microsoft's CVE record shows exploit code maturity 'unproven'.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Office LTSC 2021","fixed":["16.0.14334.21048"],"affected":">= 16.0.1, < 16.0.14334.21048","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2024","fixed":["16.0.17932.21140"],"affected":">= 16.0.0, < 16.0.17932.21140","ecosystem":"vendor"},{"name":"Microsoft 365 Apps for Enterprise","fixed":[],"affected":">= 16.0.1, < build per channel (aka.ms/OfficeSecurityReleases)","ecosystem":"vendor"},{"name":"Microsoft Office 365 for Mac","fixed":["16.115.26110837"],"affected":">= 1.0.0, < 16.115.26110837","ecosystem":"vendor"},{"name":"Microsoft Office LTSC for Mac 2021","fixed":["16.115.26110837"],"affected":">= 16.0.1, < 16.115.26110837","ecosystem":"vendor"},{"name":"Microsoft Office LTSC for Mac 2024","fixed":["16.115.26110837"],"affected":">= 16.0.0, < 16.115.26110837","ecosystem":"vendor"}],"ecosystems":[],"tags":["macos","microsoft-office","other","user-interaction","windows","word"],"not_affected_if":["patched-build","unknown"],"how_to_check":"Windows: in Word open File > Account > About Word and compare the build with the fixed builds: Office LTSC 2021 16.0.14334.21048, LTSC 2024 16.0.17932.21140. For Microsoft 365 Apps, the fixed build is per update channel and is listed at https://aka.ms/OfficeSecurityReleases. Mac: Word > About Word, fixed is 16.115.26110837.","fix":"Install the November 2026 Office updates: Windows LTSC 2021 16.0.14334.21048, LTSC 2024 16.0.17932.21140, Microsoft 365 Apps the channel build listed at aka.ms/OfficeSecurityReleases; Mac (Office 365, LTSC 2021, LTSC 2024) 16.115.26110837.","status":"open","published_at":"2026-11-10T19:18:23+00:00","first_seen_at":"2026-11-10T19:24:27+00:00","triaged_at":"2026-11-10T19:32:30+00:00","updated_at":"2026-11-11T00:33:14+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-10T19:32:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Word: heap buffer overflow lets attacker run code over network","impact":"high","summary":"A heap-based buffer overflow in Microsoft Office Word lets an unauthorized attacker trigger memory corruption over a network. A successful attack lets the attacker execute code on the affected machine.","audience":"businesses","category":"other","nicknames":[],"who_cares":["microsoft-office","word","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the victim's machine via a crafted document","analyst_note":"Check Microsoft's MSRC advisory for CVE-2026-110061 for affected builds, fixed update, and whether user interaction (opening a file) is required.","how_to_check":"- Open Word and check the version under File > Account > About Word, then compare it with the fixed builds in Microsoft's advisory\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Microsoft Office Word on desktops or servers that open documents from outside sources are the likely exposure. The sources do not state affected builds or whether preview panes or specific file types are involved.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000686,"input_tokens":4494,"output_tokens":474,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Microsoft's MSRC advisory for CVE-2026-110061 for affected builds, fixed update, and whether user interaction (opening a file) is required.","search":"'-110061':15A,18A '-122':69B '-2026':14A,17A '10':107B '2021':22A,42A '2024':26A,48A '2026':108B '365':28A,34A '8.8':74B 'allow':131C 'apps':29A 'attack':81B,134C 'automat':112B 'av':75B 'base':61B,124C 'buffer':11A,62B,125C 'chat':96B 'cisa':104B 'code':7A,98B,119B,137C 'craft':3A,89B 'current':102B 'cve':13A,16A,115B 'cvss':73B 'cwe':68B 'deliv':91B 'document':4A 'download':97B 'email':95B 'enterprise':31A 'execut':136C 'exploit':109B,118B 'file':90B 'for':30A,35A,40A,46A 'get':83B 'heap':10A,60B,123C 'heap-bas':59B,122C 'interact':56B 'l/pr':77B 'ltsc':21A,25A,39A,45A 'mac':36A,41A,47A 'maco':49B 'matur':120B 'microsoft':1A,19A,23A,27A,32A,37A,43A,51B,65B,70B,113B,128C 'microsoft-offic':50B 'must':82B 'n/ac':76B 'n/ui':78B 'network':94B,140C 'none':110B 'nov':106B 'offic':52B,66B,129C 'office':20A,24A,33A,38A,44A 'open':9A,87B 'overflow':12A,63B,126C 'r':79B 'rate':71B 'record':116B 'run':6A,99B 'show':117B 'ssvc':105B 'unauthor':133C 'unproven':121B 'user':55B,85B,103B 'user-interact':54B 'window':57B 'word':2A,58B,67B,130C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Word from Microsoft 365 Apps, Office LTSC 2021 or LTSC 2024 on Windows, or Office for Mac, at a version older than the fixed builds. An attacker needs a user to open a crafted document, so teams that receive files from outside are most at risk. Whether the preview pane is a path is not stated in the record.","tier":"B","verified":{"fix":{"at":"2026-11-11T00:33:14Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-110061","run_id":3360},"products":{"at":"2026-11-11T00:33:14Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-110061","run_id":3360}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["365appsforenterprise","microsoft365appsforenterprise","microsoftoffice365formac","microsoftofficeltsc2021","microsoftofficeltsc2024","microsoftofficeltscformac2021","microsoftofficeltscformac2024","office365formac","officeltsc2021","officeltsc2024","officeltscformac2021","officeltscformac2024"],"ptokens":["2021","2024","365","apps","enterprise","for","ltsc","mac","microsoft","office"],"labels":["high","macos","microsoftoffice","other","userinteraction","windows","word"],"campaign_type":null,"search_a":"'-110061':15A,18A '-2026':14A,17A '2021':22A,42A '2024':26A,48A '365':28A,34A 'apps':29A 'buffer':11A 'code':7A 'craft':3A 'cve':13A,16A 'document':4A 'enterprise':31A 'for':30A,35A,40A,46A 'heap':10A 'ltsc':21A,25A,39A,45A 'mac':36A,41A,47A 'microsoft':1A,19A,23A,27A,32A,37A,43A 'office':20A,24A,33A,38A,44A 'open':9A 'overflow':12A 'run':6A 'word':2A","search_b":"'-122':69B '10':107B '2026':108B '8.8':74B 'attack':81B 'automat':112B 'av':75B 'base':61B 'buffer':62B 'chat':96B 'cisa':104B 'code':98B,119B 'craft':89B 'current':102B 'cve':115B 'cvss':73B 'cwe':68B 'deliv':91B 'download':97B 'email':95B 'exploit':109B,118B 'file':90B 'get':83B 'heap':60B 'heap-bas':59B 'interact':56B 'l/pr':77B 'maco':49B 'matur':120B 'microsoft':51B,65B,70B,113B 'microsoft-offic':50B 'must':82B 'n/ac':76B 'n/ui':78B 'network':94B 'none':110B 'nov':106B 'offic':52B,66B 'open':87B 'overflow':63B 'r':79B 'rate':71B 'record':116B 'run':99B 'show':117B 'ssvc':105B 'unproven':121B 'user':55B,85B,103B 'user-interact':54B 'window':57B 'word':58B,67B","search_c":"'allow':131C 'attack':134C 'base':124C 'buffer':125C 'code':137C 'execut':136C 'heap':123C 'heap-bas':122C 'microsoft':128C 'network':140C 'offic':129C 'overflow':126C 'unauthor':133C 'word':130C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110061","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110061","severity":null,"published_at":"2026-11-10T19:18:23+00:00","modified_at":"2026-11-10T19:18:24+00:00","first_seen_at":"2026-11-10T19:24:27+00:00","fetched_at":"2026-11-10T19:24:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110061:3360","url":"https://cveawg.mitre.org/api/cve/CVE-2026-110061","severity":null,"published_at":"2026-11-11T00:33:14+00:00","modified_at":"2026-11-11T00:33:14+00:00","first_seen_at":"2026-11-11T00:33:14+00:00","fetched_at":"2026-11-11T00:33:14+00:00","note":"Read Microsoft's CNA CVE record (MSRC page is JS-only and rendered empty). Versions/fixes from it; no exploitation (CISA SSVC none), no PoC found. UI required. M365 Apps fixed build not in record.","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-110061"]}],"documents":[{"id":120848,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-110061","title":"CVE record CVE-2026-110061 (Microsoft CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}