{"id":"CVE-2026-111306","kind":"vulnerability","aliases":["CVE-2026-111306"],"related":[],"title":"Microsoft Word: heap buffer overflow lets an attacker run code remotely","description":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in Microsoft Office Word lets an unauthorized attacker run code over a network. The sources give a CVSS score of 8.8 and do not say which Word versions are affected or how a document would be delivered.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["microsoft-office","other","windows","word"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:28+00:00","first_seen_at":"2026-11-10T19:24:29+00:00","triaged_at":"2026-11-10T19:32:14+00:00","updated_at":"2026-11-10T19:32:14+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T19:32:14Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Microsoft Word: heap buffer overflow lets an attacker run code remotely","impact":"high","summary":"A heap-based buffer overflow in Microsoft Office Word lets an unauthorized attacker run code over a network. The sources give a CVSS score of 8.8 and do not say which Word versions are affected or how a document would be delivered.","audience":"everyone","category":"other","nicknames":[],"who_cares":["microsoft-office","word","windows"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the victim's machine over the network","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-111306 for affected Word versions, the fixed build, and whether user interaction (opening a file) is required.","how_to_check":"- unknown","plain_action":"Update Microsoft Word through Microsoft's normal update channel once Microsoft publishes a fix.","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations and people who open Word documents from untrusted sources may be exposed. The sources do not name the affected Word versions or the exact trigger, so the exposure scope is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000685,"input_tokens":4494,"output_tokens":471,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-111306 for affected Word versions, the fixed build, and whether user interaction (opening a file) is required.","search":"'-111306':14A,17A '-2026':13A,16A '8.8':50B 'affect':59B 'allow':76C 'attack':8A,37B,79C 'base':27B,69C 'buffer':4A,28B,70C 'code':10A,39B,82C 'cve':12A,15A 'cvss':47B 'deliv':66B 'document':63B 'execut':81C 'give':45B 'heap':3A,26B,68C 'heap-bas':25B,67C 'let':6A,34B 'microsoft':1A,19B,31B,73C 'microsoft-offic':18B 'network':42B,85C 'offic':20B,32B,74C 'overflow':5A,29B,71C 'remot':11A 'run':9A,38B 'say':54B 'score':48B 'sourc':44B 'unauthor':36B,78C 'version':57B 'window':22B 'word':2A,23B,33B,56B,75C 'would':64B","nicknames":[],"mitigations":[],"who_affected":"Organizations and people who open Word documents from untrusted sources may be exposed. The sources do not name the affected Word versions or the exact trigger, so the exposure scope is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Update Microsoft Word through Microsoft's normal update channel once Microsoft publishes a fix.","pkeys":[],"ptokens":[],"labels":["high","microsoftoffice","other","windows","word"],"campaign_type":null,"search_a":"'-111306':14A,17A '-2026':13A,16A 'attack':8A 'buffer':4A 'code':10A 'cve':12A,15A 'heap':3A 'let':6A 'microsoft':1A 'overflow':5A 'remot':11A 'run':9A 'word':2A","search_b":"'8.8':50B 'affect':59B 'attack':37B 'base':27B 'buffer':28B 'code':39B 'cvss':47B 'deliv':66B 'document':63B 'give':45B 'heap':26B 'heap-bas':25B 'let':34B 'microsoft':19B,31B 'microsoft-offic':18B 'network':42B 'offic':20B,32B 'overflow':29B 'run':38B 'say':54B 'score':48B 'sourc':44B 'unauthor':36B 'version':57B 'window':22B 'word':23B,33B,56B 'would':64B","search_c":"'allow':76C 'attack':79C 'base':69C 'buffer':70C 'code':82C 'execut':81C 'heap':68C 'heap-bas':67C 'microsoft':73C 'network':85C 'offic':74C 'overflow':71C 'unauthor':78C 'word':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111306","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111306","severity":null,"published_at":"2026-11-10T19:18:28+00:00","modified_at":"2026-11-10T19:18:28+00:00","first_seen_at":"2026-11-10T19:24:29+00:00","fetched_at":"2026-11-10T19:24:29+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}