Heap-based buffer overflow in Microsoft Office for macOS and Microsoft Office - CVE-2026-110049

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the victim's system.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Word when processing crafted content. A remote attacker can induce a victim to process specially crafted content to execute arbitrary code on the victim's system.

The Preview Pane is not an attack vector for this vulnerability.

Affected software

How to mitigate CVE-2026-110049

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-110049
• https://learn.microsoft.com/en-us/officeupdates/release-notes-office-for-mac

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office