{"id":"CVE-2026-110067","kind":"vulnerability","aliases":["CVE-2026-110067"],"related":[],"title":"Microsoft Word: memory reuse flaw lets a network attacker run code","description":"Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"A use-after-free bug in Microsoft Office Word lets an unauthorized attacker run code on the victim's machine over a network. The sources give a CVSS score of 8.8 and do not say how the attack is delivered.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["microsoft-office","other","windows","word"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:24+00:00","first_seen_at":"2026-11-10T19:24:27+00:00","triaged_at":"2026-11-10T19:32:26+00:00","updated_at":"2026-11-10T19:32:26+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T19:32:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Word: memory reuse flaw lets a network attacker run code","impact":"high","summary":"A use-after-free bug in Microsoft Office Word lets an unauthorized attacker run code on the victim's machine over a network. The sources give a CVSS score of 8.8 and do not say how the attack is delivered.","audience":"everyone","category":"other","nicknames":[],"who_cares":["microsoft-office","word","windows"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the victim's machine over the network","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-110067 for affected Office builds, fixed versions and whether a user must open a file.","how_to_check":"- unknown","plain_action":"Update Microsoft Word through Microsoft Update to the version Microsoft lists for CVE-2026-110067.","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Anyone who opens documents in Microsoft Word on an unpatched version of Office is potentially exposed. The sources do not say which Office builds or delivery paths are affected, and they do not name the required user action.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000684,"input_tokens":4480,"output_tokens":473,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-110067 for affected Office builds, fixed versions and whether a user must open a file.","search":"'-110067':14A,17A '-2026':13A,16A '8.8':55B 'allow':72C 'attack':9A,37B,62B,75C 'bug':29B 'code':11A,39B,78C 'cve':12A,15A 'cvss':52B 'deliv':64B 'execut':77C 'flaw':5A 'free':28B,67C 'give':50B 'let':6A,34B 'machin':44B 'memori':3A 'microsoft':1A,19B,31B,69C 'microsoft-offic':18B 'network':8A,47B,81C 'offic':20B,32B,70C 'reus':4A 'run':10A,38B 'say':59B 'score':53B 'sourc':49B 'unauthor':36B,74C 'use':26B,65C 'use-after-fre':25B 'victim':42B 'window':22B 'word':2A,23B,33B,71C","nicknames":[],"mitigations":[],"who_affected":"Anyone who opens documents in Microsoft Word on an unpatched version of Office is potentially exposed. The sources do not say which Office builds or delivery paths are affected, and they do not name the required user action.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Update Microsoft Word through Microsoft Update to the version Microsoft lists for CVE-2026-110067.","pkeys":[],"ptokens":[],"labels":["high","microsoftoffice","other","windows","word"],"campaign_type":null,"search_a":"'-110067':14A,17A '-2026':13A,16A 'attack':9A 'code':11A 'cve':12A,15A 'flaw':5A 'let':6A 'memori':3A 'microsoft':1A 'network':8A 'reus':4A 'run':10A 'word':2A","search_b":"'8.8':55B 'attack':37B,62B 'bug':29B 'code':39B 'cvss':52B 'deliv':64B 'free':28B 'give':50B 'let':34B 'machin':44B 'microsoft':19B,31B 'microsoft-offic':18B 'network':47B 'offic':20B,32B 'run':38B 'say':59B 'score':53B 'sourc':49B 'unauthor':36B 'use':26B 'use-after-fre':25B 'victim':42B 'window':22B 'word':23B,33B","search_c":"'allow':72C 'attack':75C 'code':78C 'execut':77C 'free':67C 'microsoft':69C 'network':81C 'offic':70C 'unauthor':74C 'use':65C 'word':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110067","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110067","severity":null,"published_at":"2026-11-10T19:18:24+00:00","modified_at":"2026-11-10T19:18:25+00:00","first_seen_at":"2026-11-10T19:24:27+00:00","fetched_at":"2026-11-10T19:24:27+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}