Heap-based buffer overflow in Microsoft Office for macOS and Microsoft Office - CVE-2026-111299

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's permissions.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Word when applying a gradient text fill to an embedded shape in a specially crafted document. A remote attacker can provide such a document and convince a user to open it and apply the gradient text fill to execute arbitrary code with that user's permissions.

The Preview Pane is not an attack vector.

Affected software

How to mitigate CVE-2026-111299

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-111299
• https://learn.microsoft.com/en-us/officeupdates/release-notes-office-for-mac

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office