{"id":"CVE-2026-116717","kind":"vulnerability","aliases":["CVE-2026-116717"],"related":[],"title":"Microsoft Office: heap overflow lets a remote attacker run code","description":"Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.","summary":"Microsoft rates this heap-based buffer overflow (CWE-122) in Microsoft Office as remote code execution, CVSS 8.8 (AV:N/AC:L/PR:N/UI:R): user interaction is required, which Microsoft's CVSS vector shows but the sources do not describe the exact trigger (likely opening a crafted file). Microsoft lists it as fixed in the November 10, 2026 Office security updates. Not known to be exploited; no public PoC found.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Office","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Microsoft 365 Apps for Enterprise","fixed":["Current Channel 2610 20527.20196"],"affected":">= 16.0.1, < Nov 10 2026 builds (see aka.ms/OfficeSecurityReleases)","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2021","fixed":["16.0.14334.21048"],"affected":">= 16.0.1, < 16.0.14334.21048","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2024","fixed":["16.0.17932.21140"],"affected":"< 16.0.17932.21140","ecosystem":"vendor"},{"name":"Microsoft Office for Mac (365, LTSC 2021, LTSC 2024)","fixed":["16.115.26110837"],"affected":"< 16.115.26110837","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["macos","microsoft-office","other","rce","user-interaction","windows"],"not_affected_if":[],"how_to_check":"In any Office app: File > Account > About, and compare the build with the fixed builds. Fixed: Office LTSC 2024 Volume Licensed 16.0.17932.21140; Office LTSC 2021 Volume Licensed 16.0.14334.21048; Office for Mac (365, LTSC 2021, LTSC 2024) 16.115.26110837; Microsoft 365 Apps: see https://aka.ms/OfficeSecurityReleases (Nov 10, 2026 Current Channel 2610 build 20527.20196).","fix":"Update Office via its normal update channel to the Nov 10, 2026 release: Microsoft 365 Apps Current Channel 2610 (20527.20196), Monthly Enterprise 2610 (20527.20194) / 2609 (20430.20264) / 2608 (20326.20320); LTSC 2024 16.0.17932.21140; LTSC 2021 16.0.14334.21048; Office for Mac 16.115.26110837.","status":"open","published_at":"2026-11-10T19:19:14+00:00","first_seen_at":"2026-11-10T19:24:45+00:00","triaged_at":"2026-11-10T19:30:32+00:00","updated_at":"2026-11-10T23:38:47+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-10T19:30:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Office: heap overflow lets a remote attacker run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft Office lets an unauthorized attacker run code over a network. The sources do not describe the trigger path beyond that.","audience":"everyone","category":"other","nicknames":[],"who_cares":["microsoft-office","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker runs code on the victim's machine over the network","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-116717 for affected Office builds, fixed versions, and whether user interaction (opening a file) is required.","how_to_check":"- unknown","plain_action":"Update Microsoft Office to the latest version through Microsoft's update channel once Microsoft publishes a fix for this flaw.","product_name":"Microsoft Office","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000659,"input_tokens":4490,"output_tokens":420,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-116717 for affected Office builds, fixed versions, and whether user interaction (opening a file) is required.","search":"'-116717':13A,16A '-122':60B '-2026':12A,15A '10':107B '2021':27A,38A '2024':31A,40A '2026':108B '365':20A,36A '8.8':69B 'allow':129C 'apps':21A 'attack':8A,132C 'av':70B 'base':56B,123C 'buffer':57B,124C 'code':10A,66B,135C 'craft':97B 'cve':11A,14A 'cvss':68B,82B 'cwe':59B 'describ':90B 'enterprise':23A 'exact':92B 'execut':67B,134C 'exploit':116B 'file':98B 'fix':103B 'for':22A,34A 'found':120B 'heap':3A,55B,122C 'heap-bas':54B,121C 'interact':49B,76B 'known':113B 'l/pr':72B 'let':5A 'like':94B 'list':100B 'ltsc':26A,30A,37A,39A 'mac':35A 'maco':41B 'microsoft':1A,17A,19A,24A,28A,32A,43B,51B,62B,80B,99B,127C 'microsoft-offic':42B 'n/ac':71B 'n/ui':73B 'network':138C 'novemb':106B 'offic':2A,44B,63B,109B,128C 'office':18A,25A,29A,33A 'open':95B 'overflow':4A,58B,125C 'poc':119B 'public':118B 'r':74B 'rate':52B 'rce':46B 'remot':7A,65B 'requir':78B 'run':9A 'secur':110B 'show':84B 'sourc':87B 'trigger':93B 'unauthor':131C 'updat':111B 'user':48B,75B 'user-interact':47B 'vector':83B 'window':50B","nicknames":[],"mitigations":[],"who_affected":"Windows and Mac installs of Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and Office for Mac (365, LTSC 2021, LTSC 2024) on builds older than the November 2026 updates. Microsoft's CVSS says an attacker needs a user to take an action, so look at machines where staff open documents from email or the web. Anyone already on the November 10, 2026 build can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T23:38:47Z","by":"analyst","doc":"https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","run_id":3208},"how_to_check":{"at":"2026-11-10T23:38:47Z","by":"analyst","doc":"https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","run_id":3208}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":"Update Microsoft Office to the latest version through Microsoft's update channel once Microsoft publishes a fix for this flaw.","pkeys":["365appsforenterprise","microsoft365appsforenterprise","microsoftoffice","microsoftofficeformac365ltsc2021ltsc2024","microsoftofficeltsc2021","microsoftofficeltsc2024","office","officeformac365ltsc2021ltsc2024","officeltsc2021","officeltsc2024"],"ptokens":["2021","2024","365","apps","enterprise","for","ltsc","mac","microsoft","office"],"labels":["high","macos","microsoftoffice","other","rce","userinteraction","vendor","windows"],"campaign_type":null,"search_a":"'-116717':13A,16A '-2026':12A,15A '2021':27A,38A '2024':31A,40A '365':20A,36A 'apps':21A 'attack':8A 'code':10A 'cve':11A,14A 'enterprise':23A 'for':22A,34A 'heap':3A 'let':5A 'ltsc':26A,30A,37A,39A 'mac':35A 'microsoft':1A,17A,19A,24A,28A,32A 'offic':2A 'office':18A,25A,29A,33A 'overflow':4A 'remot':7A 'run':9A","search_b":"'-122':60B '10':107B '2026':108B '8.8':69B 'av':70B 'base':56B 'buffer':57B 'code':66B 'craft':97B 'cvss':68B,82B 'cwe':59B 'describ':90B 'exact':92B 'execut':67B 'exploit':116B 'file':98B 'fix':103B 'found':120B 'heap':55B 'heap-bas':54B 'interact':49B,76B 'known':113B 'l/pr':72B 'like':94B 'list':100B 'maco':41B 'microsoft':43B,51B,62B,80B,99B 'microsoft-offic':42B 'n/ac':71B 'n/ui':73B 'novemb':106B 'offic':44B,63B,109B 'open':95B 'overflow':58B 'poc':119B 'public':118B 'r':74B 'rate':52B 'rce':46B 'remot':65B 'requir':78B 'secur':110B 'show':84B 'sourc':87B 'trigger':93B 'updat':111B 'user':48B,75B 'user-interact':47B 'vector':83B 'window':50B","search_c":"'allow':129C 'attack':132C 'base':123C 'buffer':124C 'code':135C 'execut':134C 'heap':122C 'heap-bas':121C 'microsoft':127C 'network':138C 'offic':128C 'overflow':125C 'unauthor':131C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116717","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116717","severity":null,"published_at":"2026-11-10T19:19:14+00:00","modified_at":"2026-11-10T19:19:15+00:00","first_seen_at":"2026-11-10T19:24:45+00:00","fetched_at":"2026-11-10T19:24:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116717:3208","url":"https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","severity":null,"published_at":"2026-11-10T23:38:47+00:00","modified_at":"2026-11-10T23:38:47+00:00","first_seen_at":"2026-11-10T23:38:47+00:00","fetched_at":"2026-11-10T23:38:47+00:00","note":"MSRC page is JS-only; used Microsoft Learn Office security release notes (lists CVE under Office suite, Nov 10 2026) plus Microsoft CNA data via OpenCVE for versions. Trigger path not described; no exploitation or PoC seen. Did not mark products verified (versions came from mirror of CNA record).","cites":["https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","https://app.opencve.io/cve/CVE-2026-116717"]}],"documents":[{"id":118905,"url":"https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","title":"Release notes for Microsoft Office security updates (Nov 10, 2026)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":118905,"url":"https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","title":"Release notes for Microsoft Office security updates (Nov 10, 2026)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":120408,"url":"https://app.opencve.io/cve/CVE-2026-116717","title":"OpenCVE: CVE-2026-116717 (mirrors Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}