{"id":"CVE-2026-122198","kind":"vulnerability","aliases":["CVE-2026-122198"],"related":[],"title":"Microsoft Office: heap buffer overflow lets a remote attacker run code","description":"Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office (CVSS 8.8, network vector, user interaction required) that Microsoft says allows code execution. Affected builds, fixed versions and exploitation status are not yet confirmed from a primary source.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Office","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["microsoft-office","other","user-interaction","windows"],"not_affected_if":[],"how_to_check":"Unknown until MSRC lists builds. Check File > Account > About in an Office app for your version and build, and compare it with the fixed build on the MSRC page for CVE-2026-122198 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-122198).","fix":null,"status":"open","published_at":"2026-11-10T19:20:36+00:00","first_seen_at":"2026-11-10T19:25:11+00:00","triaged_at":"2026-11-10T19:27:43+00:00","updated_at":"2026-11-10T21:37:37+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T19:27:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Office: heap buffer overflow lets a remote attacker run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft Office lets an unauthorized attacker trigger memory corruption over a network. The sources describe code execution as the result.","audience":"everyone","category":"other","nicknames":[],"who_cares":["microsoft-office","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the affected computer over the network","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-122198 for affected Office builds, fixed versions, and whether user interaction (opening a file) is required.","how_to_check":"unknown","plain_action":"","product_name":"Microsoft Office","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000639,"input_tokens":4490,"output_tokens":381,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-122198 for affected Office builds, fixed versions, and whether user interaction (opening a file) is required.","search":"'-122198':14A,17A '-2026':13A,16A '8.8':37B 'affect':49B 'allow':46B,72C 'attack':9A,75C 'base':30B,66C 'buffer':4A,31B,67C 'build':50B 'code':11A,47B,78C 'confirm':59B 'cve':12A,15A 'cvss':36B 'execut':48B,77C 'exploit':54B 'fix':51B 'heap':3A,29B,65C 'heap-bas':28B,64C 'interact':26B,41B 'let':6A 'microsoft':1A,18A,21B,34B,44B,70C 'microsoft-offic':20B 'network':38B,81C 'offic':2A,22B,35B,71C 'office':19A 'overflow':5A,32B,68C 'primari':62B 'remot':8A 'requir':42B 'run':10A 'say':45B 'sourc':63B 'status':55B 'unauthor':74C 'user':25B,40B 'user-interact':24B 'vector':39B 'version':52B 'window':27B 'yet':58B","nicknames":[],"mitigations":[],"who_affected":"Microsoft's CVSS vector says a user has to interact, which probably means opening a crafted Office file or content that arrives by email, a download or a share. The affected Office products and builds are not confirmed yet. Systems without Office installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":["microsoftoffice","office"],"ptokens":["microsoft","office"],"labels":["high","microsoftoffice","other","userinteraction","vendor","windows"],"campaign_type":null,"search_a":"'-122198':14A,17A '-2026':13A,16A 'attack':9A 'buffer':4A 'code':11A 'cve':12A,15A 'heap':3A 'let':6A 'microsoft':1A,18A 'offic':2A 'office':19A 'overflow':5A 'remot':8A 'run':10A","search_b":"'8.8':37B 'affect':49B 'allow':46B 'base':30B 'buffer':31B 'build':50B 'code':47B 'confirm':59B 'cvss':36B 'execut':48B 'exploit':54B 'fix':51B 'heap':29B 'heap-bas':28B 'interact':26B,41B 'microsoft':21B,34B,44B 'microsoft-offic':20B 'network':38B 'offic':22B,35B 'overflow':32B 'primari':62B 'requir':42B 'say':45B 'sourc':63B 'status':55B 'user':25B,40B 'user-interact':24B 'vector':39B 'version':52B 'window':27B 'yet':58B","search_c":"'allow':72C 'attack':75C 'base':66C 'buffer':67C 'code':78C 'execut':77C 'heap':65C 'heap-bas':64C 'microsoft':70C 'network':81C 'offic':71C 'overflow':68C 'unauthor':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122198","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122198","severity":null,"published_at":"2026-11-10T19:20:36+00:00","modified_at":"2026-11-10T19:20:36+00:00","first_seen_at":"2026-11-10T19:25:11+00:00","fetched_at":"2026-11-10T19:25:11+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122198:2825","url":null,"severity":null,"published_at":"2026-11-10T21:37:37+00:00","modified_at":"2026-11-10T21:37:37+00:00","first_seen_at":"2026-11-10T21:37:37+00:00","fetched_at":"2026-11-10T21:37:37+00:00","note":"MSRC, NVD and CVE.org pages returned no text to me; no primary advisory read, so affected builds and fixed versions are unknown and nothing is verified. CVSS vector from Microsoft (secure@microsoft.com) shows AV:N/UI:R, so a user must open a crafted file or content. Sibling Office CVEs from the same period are fixed in the monthly Office security updates (learn.microsoft.com release notes), but I did not confirm that for this CVE. Revisit once MSRC lists the CVE."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}