---
id: "CVE-2026-124185"
page: "https://infrastack.ai/live/CVE-2026-124185"
kind: "vulnerability"
aliases: ["CVE-2026-124185"]
title: "Microsoft Word: uninitialized memory use lets a crafted document run code when opened"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Microsoft 365 Apps for Enterprise", "fixed": ["16.0.14334.21048", "16.0.17932.21140"], "affected": "< 16.0.14334.21048 (16.0.14334 channel); < 16.0.17932.21140 (16.0.17932 channel)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["microsoft-365", "microsoft-office", "other", "windows", "word"]
not_affected_if: ["patched"]
published_at: "2026-11-10T19:20:47+00:00"
first_seen_at: "2026-11-10T19:25:13+00:00"
updated_at: "2026-11-10T21:29:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124185", "first_seen_at": "2026-11-10T19:25:13+00:00"}, {"source": "analyst", "url": "https://radar.offseq.com/threat/cve-2026-124185-cwe-908-use-of-uninitialized-resource-in-microsoft-microsoft-365-apps-for-enterprise-b460e53c80665e16", "first_seen_at": "2026-11-10T21:29:06+00:00", "cites": ["https://radar.offseq.com/threat/cve-2026-124185-cwe-908-use-of-uninitialized-resource-in-microsoft-microsoft-365-apps-for-enterprise-b460e53c80665e16", "https://www.rapid7.com/db/vulnerabilities/cve-2026-124185/"]}]
exploit_sources: []
---

# Microsoft Word: uninitialized memory use lets a crafted document run code when opened

Link for people: https://infrastack.ai/live/CVE-2026-124185 (this .md is for agents)

Use of an uninitialized resource (CWE-908) in Microsoft Office Word. CVSS 3.1 7.5 (AV:N/AC:H/PR:N/UI:R): an unauthenticated attacker must get a user to open a crafted document or input. Not known to be exploited and no public PoC found. Fixed builds per the CVE record: 16.0.14334.21048 and 16.0.17932.21140 (Microsoft 365 Apps).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft 365 Apps for Enterprise affected < 16.0.14334.21048 (16.0.14334 channel); < 16.0.17932.21140 (16.0.17932 channel) fixed 16.0.14334.21048, 16.0.17932.21140

## How to check

Open Word, File > Account > About Word, and compare the build with the fixed builds 16.0.14334.21048 (that 16.0.14334 channel) or 16.0.17932.21140 (that 16.0.17932 channel). Confirm for your channel in the Microsoft Security Update Guide entry for CVE-2026-124185.

## Fix

Update Microsoft 365 Apps to 16.0.14334.21048 or 16.0.17932.21140 or later (Office > Account > Update Options > Update Now). Fixes for other Office editions: unknown, check the MSRC entry.

## Timeline

- 2026-11-10T19:25:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124185
- 2026-11-10T21:29:06+00:00 analyst https://radar.offseq.com/threat/cve-2026-124185-cwe-908-use-of-uninitialized-resource-in-microsoft-microsoft-365-apps-for-enterprise-b460e53c80665e16 — MSRC page is JS-only and unreadable here; fix versions come from OffSeq (CVE record data), not a primary page, so nothing verified. CVSS vector has UI:R and AC:H: the victim must open a crafted document, not a pure network attack. No exploitation or PoC found; not in KEV.

## Documents

- [describes] OffSeq Threat Radar: CVE-2026-124185 https://radar.offseq.com/threat/cve-2026-124185-cwe-908-use-of-uninitialized-resource-in-microsoft-microsoft-365-apps-for-enterprise-b460e53c80665e16
- [mentions] Rapid7: CVE-2026-124185 https://www.rapid7.com/db/vulnerabilities/cve-2026-124185/

## From the sources

Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_