{"id":"CVE-2026-116719","kind":"vulnerability","aliases":["CVE-2026-116719"],"related":[],"title":"Microsoft Word: opening a crafted file can run attacker code (heap buffer overflow)","description":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Word (CWE-122). Microsoft rates it CVSS 8.8 with user interaction required, so a victim has to open a crafted file. No exploitation known; CISA SSVC says exploitation none. Fixed in the November 2026 Patch Tuesday updates.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft 365 Apps for Enterprise","fixed":["see https://aka.ms/OfficeSecurityReleases"],"affected":">= 16.0.1, below the Nov 10 2026 build","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2021","fixed":["16.0.14334.21048"],"affected":">= 16.0.1, < 16.0.14334.21048","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2024","fixed":["16.0.17932.21140"],"affected":">= 16.0.0, < 16.0.17932.21140","ecosystem":"vendor"},{"name":"Microsoft Office 365 for Mac","fixed":["16.115.26110837"],"affected":"< 16.115.26110837","ecosystem":"vendor"},{"name":"Microsoft Office LTSC for Mac 2021","fixed":["16.115.26110837"],"affected":">= 16.0.1, < 16.115.26110837","ecosystem":"vendor"},{"name":"Microsoft Office LTSC for Mac 2024","fixed":["16.115.26110837"],"affected":">= 16.0.0, < 16.115.26110837","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["macos","microsoft-office","other","user-interaction","windows","word"],"not_affected_if":[],"how_to_check":"Open any Office app > File > Account > About and compare the build with the fixed builds: Windows LTSC 2021 16.0.14334.21048, LTSC 2024 16.0.17932.21140, Mac 16.115.26110837. For Microsoft 365 Apps, compare with the November 10, 2026 builds listed at https://aka.ms/OfficeSecurityReleases (Current Channel 2610 build 20527.20196).","fix":"Install the November 2026 Office updates: LTSC 2021 16.0.14334.21048 or later, LTSC 2024 16.0.17932.21140 or later, Office for Mac 16.115.26110837 or later, Microsoft 365 Apps to the November 10, 2026 build for your channel.","status":"open","published_at":"2026-11-10T19:19:15+00:00","first_seen_at":"2026-11-10T19:24:45+00:00","triaged_at":"2026-11-10T19:30:31+00:00","updated_at":"2026-11-10T23:38:37+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-10T19:30:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Word: heap buffer overflow lets an attacker run code remotely","impact":"high","summary":"A heap-based buffer overflow in Microsoft Office Word lets an unauthorized attacker run code over a network. The sources give no further detail on the trigger or affected versions.","audience":"everyone","category":"other","nicknames":[],"who_cares":["microsoft-office","word","windows"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the victim's machine over the network.","analyst_note":"Check Microsoft's MSRC advisory for CVE-2026-116719 for affected builds, patch details and whether user interaction (opening a file) is required.","how_to_check":"- unknown","plain_action":"Update Microsoft Word through Microsoft's usual Office updates, if an update is available for your version.","product_name":"Microsoft Office Word","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations and people running Microsoft Office Word. The sources do not list affected versions or the exact trigger, so the exposure scope is unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00068,"input_tokens":4494,"output_tokens":461,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Microsoft's MSRC advisory for CVE-2026-116719 for affected builds, patch details and whether user interaction (opening a file) is required.","search":"'-116719':16A,19A '-122':70B '-2026':15A,18A '2021':28A,43A '2024':32A,49A '2026':101B '365':21A,35A '8.8':75B 'allow':114C 'apps':22A 'attack':9A,117C 'base':62B,107C 'buffer':12A,63B,108C 'cisa':92B 'code':10A,120C 'craft':5A,87B 'cve':14A,17A 'cvss':74B 'cwe':69B 'enterprise':24A 'execut':119C 'exploit':90B,95B 'file':6A,88B 'fix':97B 'for':23A,36A,41A,47A 'heap':11A,61B,106C 'heap-bas':60B,105C 'interact':57B,78B 'known':91B 'ltsc':27A,31A,40A,46A 'mac':37A,42A,48A 'maco':50B 'microsoft':1A,20A,25A,29A,33A,38A,44A,52B,66B,71B,111C 'microsoft-offic':51B 'network':123C 'none':96B 'novemb':100B 'offic':53B,67B,112C 'office':26A,30A,34A,39A,45A 'open':3A,85B 'overflow':13A,64B,109C 'patch':102B 'rate':72B 'requir':79B 'run':8A 'say':94B 'ssvc':93B 'tuesday':103B 'unauthor':116C 'updat':104B 'user':56B,77B 'user-interact':55B 'victim':82B 'window':58B 'word':2A,59B,68B,113C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Word from Microsoft 365 Apps for Enterprise, Office LTSC 2021 or 2024 (Windows), or Office 365 / LTSC 2021 / LTSC 2024 for Mac below the fixed builds. The attacker needs a user to open a crafted document, so mail and file-sharing paths are the route to watch. Teams with fully updated Office can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Update Microsoft Word through Microsoft's usual Office updates, if an update is available for your version.","pkeys":["365appsforenterprise","microsoft365appsforenterprise","microsoftoffice365formac","microsoftofficeltsc2021","microsoftofficeltsc2024","microsoftofficeltscformac2021","microsoftofficeltscformac2024","office365formac","officeltsc2021","officeltsc2024","officeltscformac2021","officeltscformac2024"],"ptokens":["2021","2024","365","apps","enterprise","for","ltsc","mac","microsoft","office"],"labels":["high","macos","microsoftoffice","other","userinteraction","vendor","windows","word"],"campaign_type":null,"search_a":"'-116719':16A,19A '-2026':15A,18A '2021':28A,43A '2024':32A,49A '365':21A,35A 'apps':22A 'attack':9A 'buffer':12A 'code':10A 'craft':5A 'cve':14A,17A 'enterprise':24A 'file':6A 'for':23A,36A,41A,47A 'heap':11A 'ltsc':27A,31A,40A,46A 'mac':37A,42A,48A 'microsoft':1A,20A,25A,29A,33A,38A,44A 'office':26A,30A,34A,39A,45A 'open':3A 'overflow':13A 'run':8A 'word':2A","search_b":"'-122':70B '2026':101B '8.8':75B 'base':62B 'buffer':63B 'cisa':92B 'craft':87B 'cvss':74B 'cwe':69B 'exploit':90B,95B 'file':88B 'fix':97B 'heap':61B 'heap-bas':60B 'interact':57B,78B 'known':91B 'maco':50B 'microsoft':52B,66B,71B 'microsoft-offic':51B 'none':96B 'novemb':100B 'offic':53B,67B 'open':85B 'overflow':64B 'patch':102B 'rate':72B 'requir':79B 'say':94B 'ssvc':93B 'tuesday':103B 'updat':104B 'user':56B,77B 'user-interact':55B 'victim':82B 'window':58B 'word':59B,68B","search_c":"'allow':114C 'attack':117C 'base':107C 'buffer':108C 'code':120C 'execut':119C 'heap':106C 'heap-bas':105C 'microsoft':111C 'network':123C 'offic':112C 'overflow':109C 'unauthor':116C 'word':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116719","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116719","severity":null,"published_at":"2026-11-10T19:19:15+00:00","modified_at":"2026-11-10T19:19:16+00:00","first_seen_at":"2026-11-10T19:24:45+00:00","fetched_at":"2026-11-10T19:24:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116719:3206","url":"https://cveawg.mitre.org/api/cve/CVE-2026-116719","severity":null,"published_at":"2026-11-10T23:38:37+00:00","modified_at":"2026-11-10T23:38:37+00:00","first_seen_at":"2026-11-10T23:38:37+00:00","fetched_at":"2026-11-10T23:38:37+00:00","note":"Read Microsoft's CNA CVE record (MSRC page is JS-only, not read). CVSS 8.8, UI:R (user must open a crafted file), CISA SSVC exploitation none. Nothing marked verified.","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-116719","https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates"]}],"documents":[{"id":120397,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-116719","title":"CVE record published by Microsoft (CNA) for CVE-2026-116719","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":118854,"url":"https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","title":"Release notes for Microsoft Office security updates","kind":"vendor","source":"analyst","publisher":null,"text":"November 10, 2026: Current Channel 2610 (20527.20196); MEC 2610 (20527.20194), 2609 (20430.20264), 2608 (20326.20320); SAEC 2610 (20527.20192), 2609 (20430.20262), 2608 (20326.20318); Office 2024/2021 Retail 2610 (20527.20196); LTSC 2024 2408 (17932.21140); LTSC 2021 2108 (14334.21048); Office 2019 1808 (10417.20236). CVE-2026-118301 listed under Excel.","published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}