{"id":"CVE-2026-116720","kind":"vulnerability","aliases":["CVE-2026-116720"],"related":[],"title":"Microsoft Word: heap buffer overflow lets a crafted file run code (fixed in Nov 2026 updates)","description":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow (CWE-122) in Microsoft Office Word. Microsoft's record lists it as remote code execution, CVSS 8.8, network vector, no privileges, user interaction required (a victim opens a crafted file or content). Microsoft rates exploitation as unproven (E:U); no public PoC found.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft 365 Apps for Enterprise","fixed":[],"affected":">= 16.0.1, fixed per channel (aka.ms/OfficeSecurityReleases)","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2021","fixed":["16.0.14334.21048"],"affected":">= 16.0.1, < 16.0.14334.21048","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2024","fixed":["16.0.17932.21140"],"affected":">= 16.0.0, < 16.0.17932.21140","ecosystem":"vendor"},{"name":"Microsoft Office for Mac (365, LTSC 2021, LTSC 2024)","fixed":["16.115.26110837"],"affected":"< 16.115.26110837","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["macos","microsoft-office","other","user-interaction","windows","word"],"not_affected_if":[],"how_to_check":"In Word: File > Account > About Word (Mac: Word > About Word) and compare the build with the fixed versions: LTSC 2021 < 16.0.14334.21048, LTSC 2024 < 16.0.17932.21140, Mac < 16.115.26110837, Microsoft 365 Apps per aka.ms/OfficeSecurityReleases.","fix":"Update Office to the November 2026 build: Microsoft 365 Apps - see https://aka.ms/OfficeSecurityReleases for the build per channel; Office LTSC 2021 16.0.14334.21048; Office LTSC 2024 16.0.17932.21140; Office for Mac / LTSC for Mac 2021 and 2024 16.115.26110837.","status":"open","published_at":"2026-11-10T19:19:16+00:00","first_seen_at":"2026-11-10T19:24:45+00:00","triaged_at":"2026-11-10T19:30:31+00:00","updated_at":"2026-11-10T23:38:44+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-10T19:30:31Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Microsoft Word: heap buffer overflow lets an attacker run code remotely","impact":"high","summary":"A heap-based buffer overflow in Microsoft Office Word lets an unauthorized attacker run code over a network. The sources give a CVSS score of 8.8 and do not describe the exact trigger or the fixed build.","audience":"everyone","category":"other","nicknames":[],"who_cares":["microsoft-office","word","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the victim's machine over the network","analyst_note":"Check Microsoft's security update guide entry for CVE-2026-116720 for affected builds, fixed versions, and whether user interaction (opening a file) is required.","how_to_check":"- Open Word and check the version under File > Account > About Word, then compare it with Microsoft's security update guide for CVE-2026-116720\n- unknown","plain_action":"Update Microsoft Word through Microsoft's normal Office updates once a fix is released.","product_name":"Microsoft Office Word","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations and people who run Microsoft Office Word are potentially exposed, since the flaw is reachable over a network without authentication according to the description. The sources do not say which Word builds or configurations are affected, so unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000721,"input_tokens":4494,"output_tokens":544,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Microsoft's security update guide entry for CVE-2026-116720 for affected builds, fixed versions, and whether user interaction (opening a file) is required.","search":"'-116720':19A,22A '-122':61B '-2026':18A,21A '2021':31A,42A '2024':35A,44A '2026':15A '365':24A,40A '8.8':76B 'allow':112C 'apps':25A 'attack':115C 'base':57B,105C 'buffer':4A,58B,106C 'code':11A,73B,118C 'content':91B 'craft':8A,88B 'cve':17A,20A 'cvss':75B 'cwe':60B 'e':97B 'enterprise':27A 'execut':74B,117C 'exploit':94B 'file':9A,89B 'fix':12A 'for':26A,38A 'found':102B 'heap':3A,56B,104C 'heap-bas':55B,103C 'interact':52B,82B 'let':6A 'list':69B 'ltsc':30A,34A,41A,43A 'mac':39A 'maco':45B 'microsoft':1A,23A,28A,32A,36A,47B,63B,66B,92B,109C 'microsoft-offic':46B 'network':77B,121C 'nov':14A 'offic':48B,64B,110C 'office':29A,33A,37A 'open':86B 'overflow':5A,59B,107C 'poc':101B 'privileg':80B 'public':100B 'rate':93B 'record':68B 'remot':72B 'requir':83B 'run':10A 'u':98B 'unauthor':114C 'unproven':96B 'updat':16A 'user':51B,81B 'user-interact':50B 'vector':78B 'victim':85B 'window':53B 'word':2A,54B,65B,111C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Word from Microsoft 365 Apps, Office LTSC 2021 or 2024, or Office for Mac below the fixed builds is exposed if they open a malicious document. Mail and shared-file workflows are the usual route. Machines with Office already updated past the November 2026 builds can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Microsoft Word and the other Office apps to the latest version through Office's built-in update (File > Account > Update Options > Update Now).","pkeys":["365appsforenterprise","microsoft365appsforenterprise","microsoftofficeformac365ltsc2021ltsc2024","microsoftofficeltsc2021","microsoftofficeltsc2024","officeformac365ltsc2021ltsc2024","officeltsc2021","officeltsc2024"],"ptokens":["2021","2024","365","apps","enterprise","for","ltsc","mac","microsoft","office"],"labels":["high","macos","microsoftoffice","other","userinteraction","vendor","windows","word"],"campaign_type":null,"search_a":"'-116720':19A,22A '-2026':18A,21A '2021':31A,42A '2024':35A,44A '2026':15A '365':24A,40A 'apps':25A 'buffer':4A 'code':11A 'craft':8A 'cve':17A,20A 'enterprise':27A 'file':9A 'fix':12A 'for':26A,38A 'heap':3A 'let':6A 'ltsc':30A,34A,41A,43A 'mac':39A 'microsoft':1A,23A,28A,32A,36A 'nov':14A 'office':29A,33A,37A 'overflow':5A 'run':10A 'updat':16A 'word':2A","search_b":"'-122':61B '8.8':76B 'base':57B 'buffer':58B 'code':73B 'content':91B 'craft':88B 'cvss':75B 'cwe':60B 'e':97B 'execut':74B 'exploit':94B 'file':89B 'found':102B 'heap':56B 'heap-bas':55B 'interact':52B,82B 'list':69B 'maco':45B 'microsoft':47B,63B,66B,92B 'microsoft-offic':46B 'network':77B 'offic':48B,64B 'open':86B 'overflow':59B 'poc':101B 'privileg':80B 'public':100B 'rate':93B 'record':68B 'remot':72B 'requir':83B 'u':98B 'unproven':96B 'user':51B,81B 'user-interact':50B 'vector':78B 'victim':85B 'window':53B 'word':54B,65B","search_c":"'allow':112C 'attack':115C 'base':105C 'buffer':106C 'code':118C 'execut':117C 'heap':104C 'heap-bas':103C 'microsoft':109C 'network':121C 'offic':110C 'overflow':107C 'unauthor':114C 'word':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116720","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116720","severity":null,"published_at":"2026-11-10T19:19:16+00:00","modified_at":"2026-11-10T19:19:17+00:00","first_seen_at":"2026-11-10T19:24:45+00:00","fetched_at":"2026-11-10T19:24:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116720:3205","url":"https://app.opencve.io/cve/CVE-2026-116720","severity":null,"published_at":"2026-11-10T23:38:44+00:00","modified_at":"2026-11-10T23:38:44+00:00","first_seen_at":"2026-11-10T23:38:44+00:00","fetched_at":"2026-11-10T23:38:44+00:00","note":"MSRC page is JS-only and unreadable here; versions come from Microsoft's CNA record as mirrored by NVD/OpenCVE, so nothing marked verified. Microsoft rates it Remote Code Execution, CVSS 8.8 with UI:R (user must open a crafted file). No exploitation or PoC seen (E:U).","cites":["https://app.opencve.io/cve/CVE-2026-116720","https://nvd.nist.gov/vuln/detail/CVE-2026-116720"]}],"documents":[{"id":120404,"url":"https://app.opencve.io/cve/CVE-2026-116720","title":"OpenCVE: CVE-2026-116720 (mirrors Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":120406,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116720","title":"NVD: CVE-2026-116720 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}