ZDI lists November 2026 Microsoft fixes, one Outlook bug exploited
CVE-2026-124194 is the only listed flaw marked exploited; it is a Moderate CVSS 6.5 spoofing bug.
74
CVE-2026-111285
Heap buffer overflow in Microsoft Word via crafted document
- CVSS 3.1
- 8.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A heap-based buffer overflow in Microsoft Office Word lets an attacker run code when a user opens a malicious document. The attack is remote and needs no account, but the victim must interact with the file. Successful exploitation yields high impact on confidentiality, integrity, and availability of the Word process. Microsoft has not listed affected builds.
What to do: Apply Microsoft's update for CVE-2026-111285. No workaround is named.
| Product | Affected |
|---|---|
| Microsoft Office Word | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- Weakness
- CWE-122
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H