{"id":"CVE-2026-112715","kind":"vulnerability","aliases":["CVE-2026-112715"],"related":[],"title":"Microsoft Word: heap buffer overflow lets a remote attacker run code","description":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in Microsoft Office Word lets an unauthorized attacker reach code execution over a network. The NVD entry gives a CVSS score of 8.8, and the sources give no further detail on the trigger.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["microsoft-office","other","windows","word"],"not_affected_if":[],"how_to_check":"- Check the installed Word version in File > Account > About Word, or confirm Microsoft 365 is on a current channel.","fix":null,"status":"open","published_at":"2026-11-10T19:18:29+00:00","first_seen_at":"2026-11-10T19:24:29+00:00","triaged_at":"2026-11-10T19:32:09+00:00","updated_at":"2026-11-10T19:32:09+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T19:32:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Word: heap buffer overflow lets a remote attacker run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft Office Word lets an unauthorized attacker reach code execution over a network. The NVD entry gives a CVSS score of 8.8, and the sources give no further detail on the trigger.","audience":"businesses","category":"other","nicknames":[],"who_cares":["microsoft-office","word","windows"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker runs code on the machine over the network","analyst_note":"Find the Microsoft Security Update Guide entry for CVE-2026-112715 for affected builds, fixed versions and whether a document must be opened.","how_to_check":"- Check the installed Word version in File > Account > About Word, or confirm Microsoft 365 is on a current channel.\n- unknown for other checks; the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Microsoft Office Word on Windows or Mac are the likely exposure, since the flaw is in the Word component itself. The sources do not say which Word builds or configurations are affected, or whether opening a document is enough to trigger it. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0007,"input_tokens":4494,"output_tokens":501,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft Security Update Guide entry for CVE-2026-112715 for affected builds, fixed versions and whether a document must be opened.","search":"'-112715':14A,17A '-2026':13A,16A '8.8':52B 'allow':72C 'attack':9A,37B,75C 'base':27B,65C 'buffer':4A,28B,66C 'code':11A,39B,78C 'cve':12A,15A 'cvss':49B 'detail':59B 'entri':46B 'execut':40B,77C 'give':47B,56B 'heap':3A,26B,64C 'heap-bas':25B,63C 'let':6A,34B 'microsoft':1A,19B,31B,69C 'microsoft-offic':18B 'network':43B,81C 'nvd':45B 'offic':20B,32B,70C 'overflow':5A,29B,67C 'reach':38B 'remot':8A 'run':10A 'score':50B 'sourc':55B 'trigger':62B 'unauthor':36B,74C 'window':22B 'word':2A,23B,33B,71C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Microsoft Office Word on Windows or Mac are the likely exposure, since the flaw is in the Word component itself. The sources do not say which Word builds or configurations are affected, or whether opening a document is enough to trigger it. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","microsoftoffice","other","windows","word"],"campaign_type":null,"search_a":"'-112715':14A,17A '-2026':13A,16A 'attack':9A 'buffer':4A 'code':11A 'cve':12A,15A 'heap':3A 'let':6A 'microsoft':1A 'overflow':5A 'remot':8A 'run':10A 'word':2A","search_b":"'8.8':52B 'attack':37B 'base':27B 'buffer':28B 'code':39B 'cvss':49B 'detail':59B 'entri':46B 'execut':40B 'give':47B,56B 'heap':26B 'heap-bas':25B 'let':34B 'microsoft':19B,31B 'microsoft-offic':18B 'network':43B 'nvd':45B 'offic':20B,32B 'overflow':29B 'reach':38B 'score':50B 'sourc':55B 'trigger':62B 'unauthor':36B 'window':22B 'word':23B,33B","search_c":"'allow':72C 'attack':75C 'base':65C 'buffer':66C 'code':78C 'execut':77C 'heap':64C 'heap-bas':63C 'microsoft':69C 'network':81C 'offic':70C 'overflow':67C 'unauthor':74C 'word':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112715","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112715","severity":null,"published_at":"2026-11-10T19:18:29+00:00","modified_at":"2026-11-10T19:18:29+00:00","first_seen_at":"2026-11-10T19:24:29+00:00","fetched_at":"2026-11-10T19:24:29+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}