{"id":"CVE-2026-111302","kind":"vulnerability","aliases":["CVE-2026-111302"],"related":[],"title":"Microsoft Word: heap overflow lets a local attacker run code","description":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.","summary":"A heap-based buffer overflow in Microsoft Office Word lets an unauthorized attacker run code on the machine where Word runs. NVD rates it high (CVSS 7.8) and the attack is local, so it needs someone on the machine to open or run something.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["microsoft-office","microsoft-word","other","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:28+00:00","first_seen_at":"2026-11-10T19:24:29+00:00","triaged_at":"2026-11-10T19:42:22+00:00","updated_at":"2026-11-10T19:42:22+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T19:42:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Microsoft Word: heap overflow lets a local attacker run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft Office Word lets an unauthorized attacker run code on the machine where Word runs. NVD rates it high (CVSS 7.8) and the attack is local, so it needs someone on the machine to open or run something.","audience":"everyone","category":"other","nicknames":[],"who_cares":["microsoft-word","microsoft-office","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs code on the local machine with Word","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-111302 to confirm affected Office builds, the fixed update and whether user interaction (opening a file) is needed.","how_to_check":"- unknown","plain_action":"Update Microsoft Word through Microsoft's standard security updates once Microsoft publishes the fix for this flaw.","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000673,"input_tokens":4492,"output_tokens":448,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-111302 to confirm affected Office builds, the fixed update and whether user interaction (opening a file) is needed.","search":"'-111302':13A,16A '-2026':12A,15A '7.8':52B 'allow':79C 'attack':8A,38B,55B,82C 'base':28B,72C 'buffer':29B,73C 'code':10A,40B,85C 'cve':11A,14A 'cvss':51B 'execut':84C 'heap':3A,27B,71C 'heap-bas':26B,70C 'high':50B 'let':5A,35B 'local':7A,57B,86C 'machin':43B,64B 'microsoft':1A,18B,21B,32B,76C 'microsoft-offic':17B 'microsoft-word':20B 'need':60B 'nvd':47B 'offic':19B,33B,77C 'open':66B 'overflow':4A,30B,74C 'rate':48B 'run':9A,39B,46B,68B 'someon':61B 'someth':69B 'unauthor':37B,81C 'window':24B 'word':2A,22B,34B,45B,78C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","microsoftoffice","microsoftword","other","windows"],"campaign_type":null,"search_a":"'-111302':13A,16A '-2026':12A,15A 'attack':8A 'code':10A 'cve':11A,14A 'heap':3A 'let':5A 'local':7A 'microsoft':1A 'overflow':4A 'run':9A 'word':2A","search_b":"'7.8':52B 'attack':38B,55B 'base':28B 'buffer':29B 'code':40B 'cvss':51B 'heap':27B 'heap-bas':26B 'high':50B 'let':35B 'local':57B 'machin':43B,64B 'microsoft':18B,21B,32B 'microsoft-offic':17B 'microsoft-word':20B 'need':60B 'nvd':47B 'offic':19B,33B 'open':66B 'overflow':30B 'rate':48B 'run':39B,46B,68B 'someon':61B 'someth':69B 'unauthor':37B 'window':24B 'word':22B,34B,45B","search_c":"'allow':79C 'attack':82C 'base':72C 'buffer':73C 'code':85C 'execut':84C 'heap':71C 'heap-bas':70C 'local':86C 'microsoft':76C 'offic':77C 'overflow':74C 'unauthor':81C 'word':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111302","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111302","severity":null,"published_at":"2026-11-10T19:18:28+00:00","modified_at":"2026-11-10T19:18:28+00:00","first_seen_at":"2026-11-10T19:24:29+00:00","fetched_at":"2026-11-10T19:24:29+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}