---
id: "CVE-2026-110064"
page: "https://infrastack.ai/live/CVE-2026-110064"
kind: "vulnerability"
aliases: ["CVE-2026-110064"]
title: "Microsoft Word: heap buffer overflow lets a remote attacker run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Microsoft Office LTSC 2021", "fixed": ["16.0.14334.21048"], "affected": ">= 16.0.1, < 16.0.14334.21048", "ecosystem": "vendor"}, {"name": "Microsoft Office LTSC 2024", "fixed": ["16.0.17932.21140"], "affected": ">= 16.0.0, < 16.0.17932.21140", "ecosystem": "vendor"}, {"name": "Microsoft Office for Mac (365, LTSC 2021, LTSC 2024)", "fixed": ["16.115.26110837"], "affected": "< 16.115.26110837", "ecosystem": "vendor"}, {"name": "Microsoft 365 Apps for Enterprise", "fixed": [], "affected": ">= 16.0.1, below the build listed at aka.ms/OfficeSecurityReleases", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["macos", "microsoft-office", "other", "user-interaction", "windows", "word"]
not_affected_if: []
published_at: "2026-11-10T19:18:24+00:00"
first_seen_at: "2026-11-10T19:24:27+00:00"
updated_at: "2026-11-11T00:33:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110064", "first_seen_at": "2026-11-10T19:24:27+00:00"}, {"source": "analyst", "url": "https://cveawg.mitre.org/api/cve/CVE-2026-110064", "first_seen_at": "2026-11-11T00:33:24+00:00", "cites": ["https://cveawg.mitre.org/api/cve/CVE-2026-110064"]}]
exploit_sources: []
---

# Microsoft Word: heap buffer overflow lets a remote attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-110064 (this .md is for agents)

Heap-based buffer overflow (CWE-122, with numeric truncation CWE-197) in Microsoft Office Word. Microsoft rates it 8.8 High; the CVSS vector says the attacker needs the user to take an action such as opening a file (UI:R). Microsoft's CVE record lists Microsoft 365 Apps, Office LTSC 2021 and 2024, and Office for Mac. No exploitation reported; CISA SSVC says exploitation none.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Office LTSC 2021 affected >= 16.0.1, < 16.0.14334.21048 fixed 16.0.14334.21048
- vendor:Microsoft Office LTSC 2024 affected >= 16.0.0, < 16.0.17932.21140 fixed 16.0.17932.21140
- vendor:Microsoft Office for Mac (365, LTSC 2021, LTSC 2024) affected < 16.115.26110837 fixed 16.115.26110837
- vendor:Microsoft 365 Apps for Enterprise affected >= 16.0.1, below the build listed at aka.ms/OfficeSecurityReleases fixed no fixed version listed

## How to check

In Word: File > Account > About Word and compare the build. Fixed: LTSC 2021 16.0.14334.21048, LTSC 2024 16.0.17932.21140, Mac builds 16.115.26110837. For Microsoft 365 Apps, compare with https://aka.ms/OfficeSecurityReleases.

## Fix

Update Office: LTSC 2021 to 16.0.14334.21048 or later, LTSC 2024 to 16.0.17932.21140 or later, Office for Mac (365, LTSC 2021, LTSC 2024) to 16.115.26110837 or later, Microsoft 365 Apps to the current build on https://aka.ms/OfficeSecurityReleases.

## Timeline

- 2026-11-10T19:24:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110064
- 2026-11-11T00:33:24+00:00 analyst https://cveawg.mitre.org/api/cve/CVE-2026-110064 — Read Microsoft's CNA CVE record (MSRC page is JS-only, not readable). Versions/fixes from that record; no exploitation (CISA SSVC: none). Trigger: CVSS says UI:R, no vendor detail.

## Documents

- [advisory] CVE record CVE-2026-110064 (Microsoft CNA) https://cveawg.mitre.org/api/cve/CVE-2026-110064

## From the sources

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_