{"id":"CVE-2026-111290","kind":"vulnerability","aliases":["CVE-2026-111290"],"related":[],"title":"Microsoft Word: heap buffer overflow lets an attacker run code remotely","description":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office (Word) allows code execution over a network. Microsoft rates it CVSS 8.8 with user interaction required (AV:N/UI:R), so a victim typically has to open or preview a crafted file. Fixed in the November 10, 2026 Office security updates. No exploitation or public PoC found.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Office LTSC 2021","fixed":["16.0.14334.21048"],"affected":">= 16.0.1, < 16.0.14334.21048","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2024","fixed":["16.0.17932.21140"],"affected":">= 16.0.0, < 16.0.17932.21140","ecosystem":"vendor"},{"name":"Microsoft 365 Apps for Enterprise","fixed":["Current Channel 2610 build 20527.20196"],"affected":">= 16.0.1, < Nov 10 2026 build (see aka.ms/OfficeSecurityReleases)","ecosystem":"vendor"}],"ecosystems":[],"tags":["microsoft-office","other","rce","user-interaction","windows","word"],"not_affected_if":[],"how_to_check":"Open any Office app > File > Account > About and read the build. Vulnerable: Office LTSC 2021 below 16.0.14334.21048; Office LTSC 2024 below 16.0.17932.21140; Microsoft 365 Apps on a build older than the Nov 10, 2026 release (Current Channel 2610 build 20527.20196, see aka.ms/OfficeSecurityReleases for other channels).","fix":"Install the Nov 10, 2026 Office update: LTSC 2021 build 14334.21048 or later; LTSC 2024 build 17932.21140 or later; Microsoft 365 Apps Current Channel 2610 build 20527.20196 or later (Monthly Enterprise 2610 20527.20194, 2609 20430.20264, 2608 20326.20320).","status":"open","published_at":"2026-11-10T19:18:26+00:00","first_seen_at":"2026-11-10T19:24:28+00:00","triaged_at":"2026-11-10T19:32:21+00:00","updated_at":"2026-11-11T00:29:59+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-10T19:32:21Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Microsoft Word: heap buffer overflow lets an attacker run code remotely","impact":"high","summary":"A heap-based buffer overflow in Microsoft Office Word lets an unauthorized attacker run code over a network. The sources give no further detail on the trigger or the affected Word versions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["microsoft-office","word","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the victim's computer over the network.","analyst_note":"Find Microsoft's security update guide entry for CVE-2026-111290 to confirm affected Word versions, the fixed build, and whether user interaction (opening a file) is required.","how_to_check":"- Check the installed Word version in File > Account > About Word, and compare it with Microsoft's security update guide for CVE-2026-111290.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Microsoft Office Word that can receive documents from outside sources. The sources do not name the affected Word versions or the exact trigger.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000679,"input_tokens":4494,"output_tokens":459,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Microsoft's security update guide entry for CVE-2026-111290 to confirm affected Word versions, the fixed build, and whether user interaction (opening a file) is required.","search":"'-111290':14A,17A '-2026':13A,16A '10':84B '2021':21A '2024':25A '2026':85B '365':27A '8.8':60B 'allow':50B,104C 'apps':28A 'attack':8A,107C 'av':65B 'base':43B,97C 'buffer':4A,44B,98C 'code':10A,51B,110C 'craft':78B 'cve':12A,15A 'cvss':59B 'enterprise':30A 'execut':52B,109C 'exploit':90B 'file':79B 'fix':80B 'for':29A 'found':94B 'heap':3A,42B,96C 'heap-bas':41B,95C 'interact':38B,63B 'let':6A 'ltsc':20A,24A 'microsoft':1A,18A,22A,26A,32B,47B,56B,101C 'microsoft-offic':31B 'n/ui':66B 'network':55B,113C 'novemb':83B 'offic':33B,48B,86B,102C 'office':19A,23A 'open':74B 'overflow':5A,45B,99C 'poc':93B 'preview':76B 'public':92B 'r':67B 'rate':57B 'rce':35B 'remot':11A 'requir':64B 'run':9A 'secur':87B 'typic':71B 'unauthor':106C 'updat':88B 'user':37B,62B 'user-interact':36B 'victim':70B 'window':39B 'word':2A,40B,49B,103C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Microsoft Office Word that can receive documents from outside sources. The sources do not name the affected Word versions or the exact trigger.","tier":"B","verified":{"fix":{"at":"2026-11-11T00:29:59Z","by":"analyst","doc":"https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","run_id":3350},"products":{"at":"2026-11-11T00:29:59Z","by":"analyst","doc":"https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","run_id":3350}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["365appsforenterprise","microsoft365appsforenterprise","microsoftofficeltsc2021","microsoftofficeltsc2024","officeltsc2021","officeltsc2024"],"ptokens":["2021","2024","365","apps","enterprise","for","ltsc","microsoft","office"],"labels":["high","microsoftoffice","other","rce","userinteraction","windows","word"],"campaign_type":null,"search_a":"'-111290':14A,17A '-2026':13A,16A '2021':21A '2024':25A '365':27A 'apps':28A 'attack':8A 'buffer':4A 'code':10A 'cve':12A,15A 'enterprise':30A 'for':29A 'heap':3A 'let':6A 'ltsc':20A,24A 'microsoft':1A,18A,22A,26A 'office':19A,23A 'overflow':5A 'remot':11A 'run':9A 'word':2A","search_b":"'10':84B '2026':85B '8.8':60B 'allow':50B 'av':65B 'base':43B 'buffer':44B 'code':51B 'craft':78B 'cvss':59B 'execut':52B 'exploit':90B 'file':79B 'fix':80B 'found':94B 'heap':42B 'heap-bas':41B 'interact':38B,63B 'microsoft':32B,47B,56B 'microsoft-offic':31B 'n/ui':66B 'network':55B 'novemb':83B 'offic':33B,48B,86B 'open':74B 'overflow':45B 'poc':93B 'preview':76B 'public':92B 'r':67B 'rate':57B 'rce':35B 'requir':64B 'secur':87B 'typic':71B 'updat':88B 'user':37B,62B 'user-interact':36B 'victim':70B 'window':39B 'word':40B,49B","search_c":"'allow':104C 'attack':107C 'base':97C 'buffer':98C 'code':110C 'execut':109C 'heap':96C 'heap-bas':95C 'microsoft':101C 'network':113C 'offic':102C 'overflow':99C 'unauthor':106C 'word':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111290","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111290","severity":null,"published_at":"2026-11-10T19:18:26+00:00","modified_at":"2026-11-10T19:18:26+00:00","first_seen_at":"2026-11-10T19:24:28+00:00","fetched_at":"2026-11-10T19:24:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111290:3350","url":"https://nvd.nist.gov/vuln/detail/cve-2026-111290","severity":null,"published_at":"2026-11-11T00:29:59+00:00","modified_at":"2026-11-11T00:29:59+00:00","first_seen_at":"2026-11-11T00:29:59+00:00","fetched_at":"2026-11-11T00:29:59+00:00","note":"Microsoft CNA data (via NVD) gives affected ranges; Learn release notes list the CVE under Nov 10 2026 'Office suite' fixes with build numbers. MSRC guide page is JS-only and returned nothing, so exploitation status and mitigations unconfirmed; no exploitation seen (not in KEV).","cites":["https://nvd.nist.gov/vuln/detail/cve-2026-111290","https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates"]}],"documents":[{"id":120818,"url":"https://nvd.nist.gov/vuln/detail/cve-2026-111290","title":"NVD CVE-2026-111290 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":118905,"url":"https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","title":"Release notes for Microsoft Office security updates (Nov 10, 2026 lists CVE-2026-110053 under Word)","kind":"vendor","source":"analyst","publisher":null,"text":"November 10, 2026 release lists CVE-2026-112719 under Word. Current Channel 2610 build 20527.20196; Monthly Enterprise 2610 20527.20194, 2609 20430.20264, 2608 20326.20320; Semi-Annual Enterprise 2610 20527.20192, 2609 20430.20262, 2608 20326.20318; Office 2024/2021 Retail 2610 20527.20196; LTSC 2024 VL 2408 build 17932.21140; LTSC 2021 VL 2108 build 14334.21048; Office 2019 VL 1808 build 10417.20236.","published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}