{"@odata.context":"https://api.msrc.microsoft.com/sug/v2.0/sugodata/v2.0/en-US/$metadata#vulnerability/$entity","id":"00000000-0000-0000-0000-000098b41659","releaseDate":"2026-11-10T08:00:00-08:00","cveNumber":"CVE-2026-109503","cveTitle":"Microsoft Office Word Remote Code Execution Vulnerability","releaseNumber":"2026-Nov","vulnType":"Security Vulnerability","latestRevisionDate":"2026-11-10T08:00:00-08:00","description":"<p>Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.</p>\n","cweList":["CWE-415: Double Free"],"cweDetailsListForSearch":["cwe: CWE-415: Double Free","cweUrl: https://cwe.mitre.org/data/definitions/415.html"],"unformattedDescription":"<p>Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.</p>","mitreText":"CVE-2026-109503","mitreUrl":"https://www.cve.org/CVERecord?id=CVE-2026-109503","publiclyDisclosed":"No","exploited":"No","latestSoftwareReleaseId":2,"latestSoftwareRelease":"Exploitation Less Likely","olderSoftwareReleaseId":0,"denialOfService":"N/A","tag":"Microsoft Office Word","issuingCna":"Microsoft","issuingCnaId":100000001,"severityId":100000001,"severity":"Important","impactId":100000005,"impact":"Remote Code Execution","langCode":"en-US","baseScore":"8.8","temporalScore":"7.7","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","vectorStringSource":"Microsoft","isMariner":false,"customerActionRequired":true,"customerActionRequiredId":1,"cweDetailsList":[{"keys":["cwe","cweUrl"],"values":["CWE-415: Double Free","https://cwe.mitre.org/data/definitions/415.html"]}],"articles":[{"articleType":"FAQ","description":"<p><strong>How could an attacker exploit this vulnerability?</strong></p>\n<p>An attacker could provide a specially crafted Word document and convince a user to open it and export it to PDF. Successful exploitation could allow the attacker to execute code with the user's permissions. The attacker does not need an account on the affected system.</p>\n","ordinal":10000},{"title":"Microsoft Office Word Remote Code Execution Vulnerability","articleType":"100000000","description":"<p>Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.</p>\n","ordinal":10000},{"articleType":"FAQ","description":"<p><strong>Is the Preview Pane an attack vector for this vulnerability?</strong></p>\n<p>No, the Preview Pane is not an attack vector.</p>\n","ordinal":10000}],"revisions":[{"cveNumber":"CVE-2026-109503","version":1,"revisionDate":"2026-11-10T08:00:00-08:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>Information published.</p>\n","unformattedDescription":"Information published.","notificationNeeded":false,"notificationSent":false,"sourceId":"b4ec2b00-e5cb-f111-a059-70a8a5b1ff9e"}]}