Brief Summary: Microsoft Excel CVE 2026 116927 Heap-Based Buffer Overflow Leading to Remote Code Execution

Introduction

Microsoft's November 10, 2026 Patch Tuesday release fixed a heap-based buffer overflow in Excel that can result in code execution in the context of whichever user opens and processes a crafted file. Office Online Server runs the same Excel rendering code and is serviced too, so the fix spans Windows desktop installs, Office for Mac, and server-side document rendering farms.

This post is a brief summary of what Microsoft and related public sources have published about CVE 2026 116927. Microsoft scores it at CVSS 3.1 base 8.8 (temporal 7.7) and rates it Important. Microsoft has not released low-level internals, so we focus on the published attack scenario, the fixed builds, and the operational details that matter when deploying the update.

Technical information

Root cause

Microsoft classifies the issue as CWE 122: Heap Based Buffer Overflow in Microsoft Office Excel, with remote code execution as the impact. CWE describes this weakness class as a product writing past the end of a buffer allocated on the heap. Depending on the program, the overwritten memory can include data such as function pointers, and outcomes for this class range from crashes to arbitrary code execution.

That description is general class context. Microsoft has not disclosed the specific parser, record type, file extension, vulnerable function, or heap layout involved. Excel is closed source, and the fix ships only as updated binaries, so there is no commit or diff to inspect.

Where the bug likely lives

The MSRC FAQ describes the trigger as a user opening a specially crafted file in Excel and saving it as a web page. That points toward Excel's export-to-web (HTML) path rather than the initial load or preview path, and Microsoft explicitly states that the Preview Pane is not an attack vector. Excel's web rendering code also runs in Office Online Server, which helps explain why OOS appears on the patched product list. Treat this localization as an inference from the published trigger, not a confirmed statement from Microsoft.

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• AV:N (Network): the crafted file can be delivered remotely.
• AC:L (Low complexity): no special conditions beyond the described workflow.
• PR:N (No privileges): the attacker needs no account on the target.
• UI:R (User interaction required): the victim must open the file and save it as a web page.
• S:U (Scope unchanged): impact stays within the security context of the affected component.
• C:H / I:H / A:H: High impact to confidentiality, integrity, and availability.

The temporal score of 7.7 reflects Microsoft's Remediation Level of Official Fix and exploit code maturity of Unproven. NVD shows the record as awaiting enrichment and attributes the 8.8 score and vector to Microsoft's CNA entry rather than its own assessment.

Attack flow

Based on Microsoft's documented scenario:

1. An unauthenticated attacker prepares a specially crafted file designed to corrupt heap memory during Excel's processing.
2. The attacker sends the file to the target over the network.
3. The attacker convinces the user to open the file in Excel.
4. The user saves the file as a web page, which exercises the vulnerable code path and triggers the heap overflow.
5. If exploitation succeeds, attacker-controlled code runs in the context of the current user.

Network reachability here does not mean zero interaction. Steps 3 and 4 both depend on the victim, and according to Microsoft, simply previewing the file is not sufficient.

Exploitation status

At publication, Microsoft's advisory listed the vulnerability as Exploited: No, Publicly disclosed: No, and Exploitation Less Likely, with exploit code maturity Unproven. No threat actor, campaign, or indicator of compromise is named, and the official advisory documents no public proof of concept. The CISA Known Exploited Vulnerabilities catalog content we reviewed was paginated, so we cannot confirm whether this CVE is listed or absent. These are advisory-time assessments, not proof that exploitation is impossible.

A November 2026 report covered CISA-confirmed exploitation of a different Microsoft flaw, CVE 2026 124194 in Outlook, and listed this Excel CVE separately as High and awaiting analysis. Do not attribute the Outlook activity to CVE 2026 116927.

Patch information

Status

Microsoft published official fixes on November 10, 2026 as part of Patch Tuesday. The MSRC entry sets the temporal Remediation Level to Official Fix (RL:O), and Microsoft provides no separate CVE-specific workaround.

What the fix probably changes

No source-level diff exists. CWE 122 fixes usually fall into one of three patterns in the code that copies attacker-controlled file data into a heap buffer:

• checking the declared length or count against the size of the allocated buffer
• calculating the allocation size correctly, for example by guarding against integer overflow
• rejecting malformed structures before copying them

This is an educated guess based on the bug class, not a confirmed description of Microsoft's change.

Fixed builds

Any build lower than the one listed is vulnerable.

Microsoft 365 Apps

There is no single fixed build, because each update channel receives its own patched build. NVD records the upper bound as the aka.ms/OfficeSecurityReleases link rather than a version number. Confirm each device is on the November 10, 2026 security build for its channel (see Affected systems and versions below for the listed builds).

For Microsoft 365 Apps or Office for Windows, Microsoft's support guidance is to open an Office app, go to File > Account (or Office Account), then under Product Information select Update Options > Update Now. If Update Now is not visible, enable updates first. For volume-licensed installations or systems managed through Group Policy, use Microsoft Update or contact the organization's help desk.

Office Online Server (KB5002946)

• Bundled fixes: the KB states it fixes Excel remote code execution and information disclosure vulnerabilities and lists dozens of Excel CVEs from this release, including CVE 2026 116927. Installing KB5002946 addresses all of them together.
• Prerequisite: the release version of Office Online Server must already be installed.
• Supersedence: it replaces the earlier security update KB5002928, so you do not need to install both.
• Sources: Microsoft Update, the Microsoft Update Catalog, or the Download Center (download id 108899).
• Package integrity: the standalone installer is wacserver2019-kb5002946-fullfile-x64-glb.exe with SHA 256 F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0. Verify the hash before installing in offline deployments.
• Changed files: Microsoft publishes a CSV of every file in the update, linked from the KB page. Use it to confirm that the Excel rendering binaries on a farm were actually replaced.

Office Online Server updates need more care than desktop patches. Microsoft's documentation states that automatic updates are unsupported for OOS and may prevent users from viewing or editing documents. For a single server, the documented process removes the server from the farm, applies the update, and recreates the farm. Office Online is unavailable during that window, so Microsoft advises scheduling it during noncritical or nonbusiness hours. For a multiple-server farm, Microsoft describes updating one server at a time, removing each from the load balancer and farm, and returning it only once the updated farm can support traffic. Review the farm configuration and follow Microsoft's full procedure before starting.

Verifying the patch

With no code-level signal available, verification comes down to version numbers. Compare installed Office or OOS builds against the table above. On Click to Run installs, confirm the channel has picked up the November 10, 2026 build. On OOS, confirm the farm reports build 16.0.10417.20236 or later. Do not treat the absence of exploitation reports as a substitute for patching.

Affected systems and versions

The following products are affected at builds below the listed fixed versions:

• Microsoft 365 Apps for Enterprise (32 bit and 64 bit), November 10, 2026 fixed builds:
  • Current Channel: Version 2610 Build 20527.20196
  • Monthly Enterprise Channel: Version 2610 Build 20527.20194; Version 2609 Build 20430.20264; Version 2608 Build 20326.20320
  • Semi Annual Enterprise Channel: Version 2610 Build 20527.20192; Version 2609 Build 20430.20262; Version 2608 Build 20326.20318
• Office 2024 Retail and Office 2021 Retail: Version 2610 Build 20527.20196
• Microsoft Office LTSC 2021 (32 bit and 64 bit): builds below 16.0.14334.21048
• Microsoft Office LTSC 2024 (32 bit and 64 bit): builds below 16.0.17932.21140
• Microsoft Office 365 for Mac: builds below 16.115.26110837
• Microsoft Office LTSC for Mac 2021 and 2024: builds below 16.115.26110837
• Office Online Server: builds below 16.0.10417.20236 (fixed by KB5002946)

The vulnerable configuration documented by Microsoft is a user opening a crafted file in Excel and saving it as a web page. Confirm the applicable product, architecture, and channel in Microsoft's linked release records before treating a device as remediated.

Vendor security history

The European Commission's preliminary assessment identified Word, Excel, PowerPoint, and Outlook as Microsoft's core SaaS productivity applications and found Microsoft dominant worldwide in that segment for professional use, with Google as the only credible rival. That finding covers the productivity suite broadly, not a separate Excel market-share figure, but it does illustrate how widely this code is deployed.

On security governance, the Cyber Safety Review Board's review of the 2023 Exchange Online intrusion found the incident preventable and said Microsoft's operational and strategic decisions pointed to a corporate culture that deprioritized enterprise security investment and rigorous risk management. The Board called for fundamental, security-focused reforms.

Microsoft's July 2026 Secure Future Initiative progress report describes its response as embedding security across culture, governance, and engineering. Microsoft reports three objectives at target state, three nearing completion, and twelve with significant progress; 99.97% user and device coverage for phishing-resistant multifactor authentication; remediation of more than 550,000 critical and high-risk open-source vulnerability instances; and publication of 1,989 CVEs. These are self-reported claims and should be read alongside the Board's independent criticism.

None of this history is evidence that CVE 2026 116927 has been exploited or resulted from the same failures. For this specific issue, Microsoft has published a fix and documented the required user action, while leaving low-level technical and workaround details unspecified.

References

• Microsoft Security Update Guide: CVE 2026 116927
• NVD entry for CVE 2026 116927
• CVE.org record for CVE 2026 116927
• KB5002946: Security update for Office Online Server
• Download Center: Security Update for Office Online Server (KB5002946)
• Office Security Releases (Microsoft 365 Apps channel builds)
• Release notes for Microsoft Office security updates
• Release notes for Office for Mac
• Apply software updates to Office Online Server
• How to update Microsoft 365 or Office for Windows
• CWE 122: Heap Based Buffer Overflow
• CISA Known Exploited Vulnerabilities Catalog
• VulDB entry for CVE 2026 116927
• cve.now entry for CVE 2026 116927
• Orbitaley: Microsoft fixes 200 vulnerabilities, including an Outlook flaw CISA confirms is being exploited
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• DHS: Cyber Safety Review Board Releases Report on Microsoft Online Exchange Incident
• Microsoft Secure Future Initiative Progress Report, July 2026
• Microsoft On the Issues: Microsoft's work to strengthen cybersecurity protection
• European Commission: Statement of Objections to Microsoft
• Summary of Commission Decision of 12 September 2025 (Microsoft Teams cases)