{"id":"CVE-2026-111294","kind":"vulnerability","aliases":["CVE-2026-111294"],"related":[],"title":"Microsoft Word: heap buffer overflow lets remote attacker run code","description":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word allows remote code execution. CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R): the user must open a crafted document. Microsoft fixed it in the November 10, 2026 Office security updates. Not listed in CISA KEV; no exploitation reported.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Office Word","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["microsoft-office","other","user-interaction","windows","word"],"not_affected_if":["patched-nov-2026"],"how_to_check":"In any Office app open File > Account > About and compare the build with the fixed builds. Fleet check: the installed Office version is below the Nov 10, 2026 build for its channel.","fix":"Update Office to the Nov 10, 2026 builds: Current Channel 2610 build 20527.20196; Monthly Enterprise 2610 build 20527.20194 (2609: 20430.20264, 2608: 20326.20320); Office LTSC 2024 build 17932.21140; LTSC 2021 build 14334.21048; Office 2019 volume build 10417.20236.","status":"open","published_at":"2026-11-10T19:18:26+00:00","first_seen_at":"2026-11-10T19:24:28+00:00","triaged_at":"2026-11-10T19:32:23+00:00","updated_at":"2026-11-11T00:29:58+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T19:32:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Word: heap buffer overflow lets remote attacker run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft Office Word lets an unauthorized attacker run code over a network. The sources give no further detail on the trigger or the affected versions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["microsoft-office","word","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary code on the machine over the network","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-111294 for affected builds, fixed versions and whether user interaction (opening a document) is required.","how_to_check":"- unknown","plain_action":"","product_name":"Microsoft Office Word","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations that run Microsoft Office Word are exposed. The sources do not say which Word versions are affected or what user action is needed to trigger it.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000666,"input_tokens":4494,"output_tokens":433,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-111294 for affected builds, fixed versions and whether user interaction (opening a document) is required.","search":"'-111294':13A,16A '-2026':12A,15A '10':63B '2026':64B '3.1':43B '8.8':44B 'allow':38B,85C 'attack':8A,88C 'av':45B 'base':31B,78C 'buffer':4A,32B,79C 'cisa':71B 'code':10A,40B,91C 'craft':55B 'cve':11A,14A 'cvss':42B 'document':56B 'execut':41B,90C 'exploit':74B 'fix':58B 'heap':3A,30B,77C 'heap-bas':29B,76C 'interact':26B 'kev':72B 'l/pr':47B 'let':6A 'list':69B 'microsoft':1A,17A,21B,35B,57B,82C 'microsoft-offic':20B 'must':52B 'n/ac':46B 'n/ui':48B 'network':94C 'novemb':62B 'offic':22B,36B,65B,83C 'office':18A 'open':53B 'overflow':5A,33B,80C 'r':49B 'remot':7A,39B 'report':75B 'run':9A 'secur':66B 'unauthor':87C 'updat':67B 'user':25B,51B 'user-interact':24B 'window':27B 'word':2A,19A,28B,37B,84C","nicknames":[],"mitigations":[],"who_affected":"Organizations that run Microsoft Office Word are exposed. The sources do not say which Word versions are affected or what user action is needed to trigger it.","tier":"B","verified":{"fix":{"at":"2026-11-11T00:29:58Z","by":"analyst","doc":"https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","run_id":3349}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["microsoftofficeword","officeword"],"ptokens":["microsoft","office","word"],"labels":["high","microsoftoffice","other","userinteraction","vendor","windows","word"],"campaign_type":null,"search_a":"'-111294':13A,16A '-2026':12A,15A 'attack':8A 'buffer':4A 'code':10A 'cve':11A,14A 'heap':3A 'let':6A 'microsoft':1A,17A 'office':18A 'overflow':5A 'remot':7A 'run':9A 'word':2A,19A","search_b":"'10':63B '2026':64B '3.1':43B '8.8':44B 'allow':38B 'av':45B 'base':31B 'buffer':32B 'cisa':71B 'code':40B 'craft':55B 'cvss':42B 'document':56B 'execut':41B 'exploit':74B 'fix':58B 'heap':30B 'heap-bas':29B 'interact':26B 'kev':72B 'l/pr':47B 'list':69B 'microsoft':21B,35B,57B 'microsoft-offic':20B 'must':52B 'n/ac':46B 'n/ui':48B 'novemb':62B 'offic':22B,36B,65B 'open':53B 'overflow':33B 'r':49B 'remot':39B 'report':75B 'secur':66B 'updat':67B 'user':25B,51B 'user-interact':24B 'window':27B 'word':28B,37B","search_c":"'allow':85C 'attack':88C 'base':78C 'buffer':79C 'code':91C 'execut':90C 'heap':77C 'heap-bas':76C 'microsoft':82C 'network':94C 'offic':83C 'overflow':80C 'unauthor':87C 'word':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111294","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111294","severity":null,"published_at":"2026-11-10T19:18:26+00:00","modified_at":"2026-11-10T19:18:26+00:00","first_seen_at":"2026-11-10T19:24:28+00:00","fetched_at":"2026-11-10T19:24:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111294:3349","url":"https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","severity":null,"published_at":"2026-11-11T00:29:58+00:00","modified_at":"2026-11-11T00:29:58+00:00","first_seen_at":"2026-11-11T00:29:58+00:00","fetched_at":"2026-11-11T00:29:58+00:00","note":"MSRC page is JS-only and returned nothing. Microsoft's Learn release notes (Nov 10 2026) list this CVE under Office suite, fixed in the Nov 10 builds. Per-CVE affected ranges not read; the sibling CVE-2026-111290 lists 16.0.1 < 16.0.14334.21048 for LTSC 2021, but that is not this CVE. CVSS 8.8 from Rapid7 (UI:R, so a document must be opened). No KEV listing, no exploitation seen.","cites":["https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","https://www.rapid7.com/db/vulnerabilities/cve-2026-111294/"]}],"documents":[{"id":118905,"url":"https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","title":"Release notes for Microsoft Office security updates (Nov 10, 2026 lists CVE-2026-110053 under Word)","kind":"vendor","source":"analyst","publisher":null,"text":"November 10, 2026 release lists CVE-2026-112719 under Word. Current Channel 2610 build 20527.20196; Monthly Enterprise 2610 20527.20194, 2609 20430.20264, 2608 20326.20320; Semi-Annual Enterprise 2610 20527.20192, 2609 20430.20262, 2608 20326.20318; Office 2024/2021 Retail 2610 20527.20196; LTSC 2024 VL 2408 build 17932.21140; LTSC 2021 VL 2108 build 14334.21048; Office 2019 VL 1808 build 10417.20236.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":120819,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-111294/","title":"Rapid7: CVE-2026-111294","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}