{"id":"CVE-2026-120003","kind":"vulnerability","aliases":["CVE-2026-120003"],"related":[],"title":"Microsoft Office: heap buffer overflow lets an attacker run code when a user opens a crafted file","description":"Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.","summary":"Microsoft rates this heap-based buffer overflow (CWE-122) in Microsoft Office as remote code execution, CVSS 3.1 8.8. The vector needs user interaction (UI:R), so the attack most likely depends on a user opening attacker-supplied content; Microsoft's record does not describe the trigger. No exploitation reported; CISA SSVC lists exploitation none, and it is not in KEV. No public proof of concept found.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft 365 Apps for Enterprise","fixed":[],"affected":">= 16.0.1, fixed build per channel at aka.ms/OfficeSecurityReleases","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2021","fixed":["16.0.14334.21048"],"affected":">= 16.0.1, < 16.0.14334.21048","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2024","fixed":["16.0.17932.21140"],"affected":">= 16.0.0, < 16.0.17932.21140","ecosystem":"vendor"},{"name":"Microsoft Office 365 for Mac","fixed":["16.115.26110837"],"affected":">= 1.0.0, < 16.115.26110837","ecosystem":"vendor"},{"name":"Microsoft Office LTSC for Mac 2021","fixed":["16.115.26110837"],"affected":">= 16.0.1, < 16.115.26110837","ecosystem":"vendor"},{"name":"Microsoft Office LTSC for Mac 2024","fixed":["16.115.26110837"],"affected":">= 16.0.0, < 16.115.26110837","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["macos","microsoft-office","other","user-interaction","windows"],"not_affected_if":[],"how_to_check":"Check your Office build: in an Office app go to File > Account > About, or run 'Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Office\\ClickToRun\\Configuration' and read VersionToReport. LTSC 2021 below 16.0.14334.21048, LTSC 2024 below 16.0.17932.21140, and Office for Mac (365, LTSC 2021, LTSC 2024) below 16.115.26110837 are affected. For Microsoft 365 Apps for Enterprise Microsoft points to https://aka.ms/OfficeSecurityReleases for the fixed build per channel.","fix":"Update Office to LTSC 2021 16.0.14334.21048, LTSC 2024 16.0.17932.21140, Office for Mac 16.115.26110837, or the Microsoft 365 Apps build listed at https://aka.ms/OfficeSecurityReleases for your channel.","status":"open","published_at":"2026-11-10T19:20:26+00:00","first_seen_at":"2026-11-10T19:25:07+00:00","triaged_at":"2026-11-10T19:27:55+00:00","updated_at":"2026-11-10T22:07:08+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-10T19:27:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Office: heap buffer overflow lets a network attacker run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft Office lets an unauthorized attacker run code on the affected machine over a network. The sources give a CVSS score of 8.8 and no further detail.","audience":"everyone","category":"other","nicknames":[],"who_cares":["microsoft-office","windows"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the machine over the network","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-120003 for affected Office builds, the fixed version, and whether user interaction (such as opening a file) is required.","how_to_check":"unknown","plain_action":"Update Microsoft Office to the latest version through Microsoft's normal update channel once Microsoft publishes a fix.","product_name":"Microsoft Office","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000663,"input_tokens":4490,"output_tokens":428,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-120003 for affected Office builds, the fixed version, and whether user interaction (such as opening a file) is required.","search":"'-120003':20A,23A '-122':72B '-2026':19A,22A '2021':32A,47A '2024':36A,53A '3.1':81B '365':25A,39A '8.8':82B 'allow':140C 'apps':26A 'attack':8A,92B,101B,143C 'attacker-suppli':100B 'base':68B,134C 'buffer':4A,69B,135C 'cisa':115B 'code':10A,78B,146C 'concept':130B 'content':103B 'craft':16A 'cve':18A,21A 'cvss':80B 'cwe':71B 'depend':95B 'describ':109B 'enterprise':28A 'execut':79B,145C 'exploit':113B,118B 'file':17A 'for':27A,40A,45A,51A 'found':131B 'heap':3A,67B,133C 'heap-bas':66B,132C 'interact':61B,87B 'kev':125B 'let':6A 'like':94B 'list':117B 'ltsc':31A,35A,44A,50A 'mac':41A,46A,52A 'maco':54B 'microsoft':1A,24A,29A,33A,37A,42A,48A,56B,63B,74B,104B,138C 'microsoft-offic':55B 'need':85B 'network':149C 'none':119B 'offic':2A,57B,75B,139C 'office':30A,34A,38A,43A,49A 'open':14A,99B 'overflow':5A,70B,136C 'proof':128B 'public':127B 'r':89B 'rate':64B 'record':106B 'remot':77B 'report':114B 'run':9A 'ssvc':116B 'suppli':102B 'trigger':111B 'ui':88B 'unauthor':142C 'user':13A,60B,86B,98B 'user-interact':59B 'vector':84B 'window':62B","nicknames":[],"mitigations":[],"who_affected":"Any machine running the listed Office versions on Windows or Mac is exposed; Microsoft says an attacker can run code over a network, and the vector requires a user to take an action such as opening a file. Look at desktops and shared workstations that open documents from email or downloads. Machines already on the fixed builds can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:07:08Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-120003","run_id":2921},"products":{"at":"2026-11-10T22:07:08Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-120003","run_id":2921},"who_affected":{"at":"2026-11-10T22:07:08Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-120003","run_id":2921}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":"Update Microsoft Office to the latest version through Microsoft's normal update channel once Microsoft publishes a fix.","pkeys":["365appsforenterprise","microsoft365appsforenterprise","microsoftoffice365formac","microsoftofficeltsc2021","microsoftofficeltsc2024","microsoftofficeltscformac2021","microsoftofficeltscformac2024","office365formac","officeltsc2021","officeltsc2024","officeltscformac2021","officeltscformac2024"],"ptokens":["2021","2024","365","apps","enterprise","for","ltsc","mac","microsoft","office"],"labels":["high","macos","microsoftoffice","other","userinteraction","vendor","windows"],"campaign_type":null,"search_a":"'-120003':20A,23A '-2026':19A,22A '2021':32A,47A '2024':36A,53A '365':25A,39A 'apps':26A 'attack':8A 'buffer':4A 'code':10A 'craft':16A 'cve':18A,21A 'enterprise':28A 'file':17A 'for':27A,40A,45A,51A 'heap':3A 'let':6A 'ltsc':31A,35A,44A,50A 'mac':41A,46A,52A 'microsoft':1A,24A,29A,33A,37A,42A,48A 'offic':2A 'office':30A,34A,38A,43A,49A 'open':14A 'overflow':5A 'run':9A 'user':13A","search_b":"'-122':72B '3.1':81B '8.8':82B 'attack':92B,101B 'attacker-suppli':100B 'base':68B 'buffer':69B 'cisa':115B 'code':78B 'concept':130B 'content':103B 'cvss':80B 'cwe':71B 'depend':95B 'describ':109B 'execut':79B 'exploit':113B,118B 'found':131B 'heap':67B 'heap-bas':66B 'interact':61B,87B 'kev':125B 'like':94B 'list':117B 'maco':54B 'microsoft':56B,63B,74B,104B 'microsoft-offic':55B 'need':85B 'none':119B 'offic':57B,75B 'open':99B 'overflow':70B 'proof':128B 'public':127B 'r':89B 'rate':64B 'record':106B 'remot':77B 'report':114B 'ssvc':116B 'suppli':102B 'trigger':111B 'ui':88B 'user':60B,86B,98B 'user-interact':59B 'vector':84B 'window':62B","search_c":"'allow':140C 'attack':143C 'base':134C 'buffer':135C 'code':146C 'execut':145C 'heap':133C 'heap-bas':132C 'microsoft':138C 'network':149C 'offic':139C 'overflow':136C 'unauthor':142C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120003","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120003","severity":null,"published_at":"2026-11-10T19:20:26+00:00","modified_at":"2026-11-10T19:20:26+00:00","first_seen_at":"2026-11-10T19:25:07+00:00","fetched_at":"2026-11-10T19:25:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120003:2921","url":"https://cveawg.mitre.org/api/cve/CVE-2026-120003","severity":null,"published_at":"2026-11-10T22:07:08+00:00","modified_at":"2026-11-10T22:07:08+00:00","first_seen_at":"2026-11-10T22:07:08+00:00","fetched_at":"2026-11-10T22:07:08+00:00","note":"Read Microsoft's CNA CVE record (MSRC page is JS-only, not readable). Fixed builds and CVSS from there; UI:R in vector; CISA SSVC exploitation none; no KEV.","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-120003"]}],"documents":[{"id":119386,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-120003","title":"CVE record CVE-2026-120003 (CNA: Microsoft)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}