# CVE-2026-116721: Microsoft Office Word uninitialized resource information disclosure

Source: https://junglewise.ai/threats/cve-2026-116721-use-of-uninitialized-resource-in-microsoft-office-word-allows-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-116721 · Severity: medium · CVSS 6.5 · Published 2026-11-10

Microsoft Office Word contains a flaw where uninitialized memory may be accessible, allowing an attacker to read sensitive information across the network. An attacker can exploit this to disclose confidential data such as document contents or system information without authorization.

Technologies: [Microsoft Office Word](https://junglewise.ai/threats/technologies/office-word). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-116721 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116721 being exploited in the wild.

**How severe is CVE-2026-116721?** Medium severity, with a CVSS score of 6.5, published 10 November 2026.

**Which products and versions are affected?** Microsoft Office Word.

**Is there a fix for CVE-2026-116721?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-116721 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-116721?** Check whether you run Microsoft Office Word. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Microsoft Office Word fails to properly initialize memory resources before use, creating an information disclosure vulnerability. An attacker can leverage a network vector to access uninitialized memory and read sensitive data from the application's memory space. No authenticated access or user interaction is strictly required for the attack.

## Affected products

- Microsoft Office Word

## Timeline

- 2026-11-10: disclosed

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-116721](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-116721)

## Related threats

- [Microsoft Office Word buffer over-read information disclosure](https://junglewise.ai/threats/cve-2026-124233-buffer-over-read-in-microsoft-office-word-allows-an-unauthorized)
- [Microsoft Office Word use of uninitialized resource](https://junglewise.ai/threats/cve-2026-124185-use-of-uninitialized-resource-in-microsoft-office-word-allows-an)
- [Microsoft Office Word heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-123394-heap-based-buffer-overflow-in-microsoft-office-word-allows-an)
- [Microsoft Office Word heap buffer overflow](https://junglewise.ai/threats/cve-2026-116925-heap-based-buffer-overflow-in-microsoft-office-word-allows-an)
- [Microsoft Office Word heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-116923-heap-based-buffer-overflow-in-microsoft-office-word-allows-an)