---
id: "CVE-2026-112714"
page: "https://infrastack.ai/live/CVE-2026-112714"
kind: "vulnerability"
aliases: ["CVE-2026-112714"]
title: "Microsoft Word: opening a crafted file can run attacker code (heap buffer overflow)"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["microsoft-office", "other", "user-interaction", "windows", "word"]
not_affected_if: ["no-untrusted-documents"]
published_at: "2026-11-10T19:18:29+00:00"
first_seen_at: "2026-11-10T19:24:29+00:00"
updated_at: "2026-11-11T00:23:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112714", "first_seen_at": "2026-11-10T19:24:29+00:00"}, {"source": "analyst", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112714", "first_seen_at": "2026-11-11T00:23:17+00:00", "cites": ["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112714"]}]
exploit_sources: []
---

# Microsoft Word: opening a crafted file can run attacker code (heap buffer overflow)

Link for people: https://infrastack.ai/live/CVE-2026-112714 (this .md is for agents)

Microsoft's advisory (released Nov 10, 2026) rates this Word heap-based buffer overflow (CWE-122) Important, CVSS 8.8. An attacker must get a user to open a specially crafted file; the Preview Pane is not an attack vector. Microsoft lists exploitation as not observed, not publicly disclosed, and 'Exploitation Less Likely'. It lists an official fix, but the per-product build table did not render in the page text, so affected builds and fixed versions are unconfirmed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Open the Microsoft Security Update Guide entry for CVE-2026-112714, find your Office edition (Microsoft 365 Apps, Office LTSC, etc.) in the Security Updates table, and compare its fixed build number with File > Account > About Word on each machine.

## Fix

Microsoft states an official fix is available (Remediation Level: Official Fix); install the November 2026 Office/Word security update for your edition. Exact build numbers unknown: the update table did not load in the fetched page.

## Timeline

- 2026-11-10T19:24:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112714
- 2026-11-11T00:23:17+00:00 analyst https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112714 — Read MSRC page: UI:R, preview pane not a vector, not exploited, Less Likely; product/build table empty in fetched text, so nothing verified. Revisit to fill builds from the SUG table or CSAF.

## Documents

- [advisory] Microsoft Office Word Remote Code Execution Vulnerability CVE-2026-112714 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112714

## From the sources

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_