Overview of CVE-2026-118292: Microsoft Excel Stack-Based Buffer Overflow Leading to Code Execution

Introduction

A stack-based buffer overflow in Microsoft Excel, fixed in the November 10, 2026 Patch Tuesday release, could let an attacker run code with the privileges of a user who opens a crafted workbook and then saves it in a different file format. The affected list spans Microsoft 365 Apps for Enterprise, Windows and Mac Office LTSC releases, Office 365 for Mac, and Office Online Server. Remediation therefore touches both desktop fleets and server infrastructure, and each product line has its own fixed build.

The NVD record was published on 2026-11-10T19:19:42.447 with [email protected] as the source. The CVSS 3.1 base score is 8.8 (High), while Microsoft's own advisory assigns a maximum severity of Critical. At publication, Microsoft reported no exploitation and no public disclosure.

Technical information

Root cause

Microsoft classifies CVE-2026-118292 as CWE 121: Stack based Buffer Overflow. MITRE defines this weakness as writing beyond the end of a buffer allocated on the stack, with general consequences that can include crashes or arbitrary code execution. Those consequences belong to the weakness class as a whole. No internal exploit implementation for this specific CVE has been disclosed.

The advisory ties the trigger to a user opening a crafted workbook and then saving it in a different file format. That points to the code that converts or exports workbook data between formats, where data from the file is plausibly copied into a fixed-size stack buffer without adequate length checks. Microsoft has not published the vulnerable function, the exact workbook structure, the source and destination formats involved, or a payload, so read this as the general pattern for this class of bug rather than a confirmed description of Excel's code. Excel is closed source, and there is no public diff.

Documented attack flow

The MSRC advisory describes the following sequence:

1. An attacker convinces a user to open a specially crafted workbook in an affected version of Excel.
2. The user saves the workbook in a different file format.
3. Successful exploitation could allow code execution with that user's privileges.

Two details narrow the scope. First, although the description says code can be executed over a network, the advisory does not describe an automatically exploitable network service. User interaction is explicitly required, and the relevant sequence is an open followed by a format conversion. Second, Microsoft states that the Preview Pane is not an attack vector, so the risk concerns the open-and-convert path rather than file preview.

CVSS characteristics

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H   Base score 8.8
E:U/RL:O/RC:C                                   Temporal score 7.7

• Attack Vector: Network. The network classification does not remove the documented interaction requirement.
• Attack Complexity: Low.
• Privileges Required: None.
• User Interaction: Required.
• Scope: Unchanged.
• Confidentiality, Integrity, Availability: High.

The temporal values reflect Unproven exploit code maturity (E:U), an Official Fix (RL:O), and Confirmed report confidence (RC:C). The 7.7 temporal score should not be confused with the 8.8 base score.

The CNA record also includes SSVC decision attributes: exploitation "none", automatable "no", and technical impact "total". The CISA SSVC entry in NVD, timestamped 2026-11-10T19:38:46.166860Z, likewise records exploitation as none.

Exploitation status and attribution

Microsoft's assessment at publication:

• Exploited: No
• Publicly disclosed: No
• Exploitability assessment: Exploitation Less Likely
• Exploit code maturity: Unproven

Qualys corroborates the stack-based overflow classification, describing a flaw that may allow an unauthenticated attacker to execute code over a network. CrowdStrike lists the CVE as an Excel remote code execution vulnerability with a score of 8.8, without a dedicated exploit analysis. Neither report identifies a campaign, exploit sample, malware family, victim, or threat actor. We found no verified public proof of concept or CVE-specific indicators of compromise in the reviewed material. The Unproven rating means the advisory does not establish public exploit code. It does not rule out a private exploit.

Microsoft credits Jeongmin Choi (lmksecurity) in the advisory's coordinated disclosure acknowledgements.

Patch information

Microsoft fixed CVE-2026-118292 in its November 10, 2026 Patch Tuesday release. The advisory sets Remediation Level to RL:O (Official Fix), which means a complete vendor fix is available for every listed product line. The fix ships only as updated binaries, so build numbers are the evidence that a system is remediated.

A fix for this kind of flaw typically validates lengths before copying, or replaces the fixed-size stack buffer with one sized to the actual data. Microsoft has not published the exact change.

Fixed builds by product

• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): Click to Run channel update, with build numbers published at aka.ms/OfficeSecurityReleases. As one example from Microsoft's November 10, 2026 release notes, Current Channel is Version 2610, Build 20527.20196. Other channels have different builds.
• Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140
• Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048
• Microsoft Office 365 for Mac, Office LTSC for Mac 2024, Office LTSC for Mac 2021: 16.115.26110837
• Office Online Server: 16.0.10417.20236 via KB5002946

Office Online Server: KB5002946

Office Online Server is the only listed product with its own Knowledge Base package.

• One package, many CVEs: KB5002946 fixes a large batch of Excel remote code execution and information disclosure CVEs, including CVE-2026-118292. This CVE cannot be patched separately.
• Build: 16.0.10417.20236. The release version of Office Online Server must already be installed.
• Distribution: Microsoft Update (automatic when automatic updating is enabled), the Microsoft Update Catalog (search for KB5002946), or the Microsoft Download Center (download ID 108899).
• Supersedence: It replaces the earlier security update KB5002928. Because the package is cumulative, it can be installed directly without applying the October update first.
• Installer and hash: Verify manually downloaded packages before installation.

File:   wacserver2019-kb5002946-fullfile-x64-glb.exe
SHA256: F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0

This server package applies to Office Online Server only. It does not fix Windows or Mac Office clients.

Updating Windows Office clients

Microsoft's published procedure for Microsoft 365 and Office on Windows:

1. Open a Microsoft 365 app and create a new document.
2. Select File > Account.
3. Under Product Information, select Update Options > Update Now.
4. If necessary, select Enable Updates first.

If Update Options is missing and only About appears, the installation may use volume licensing or organization-managed updates through Group Policy. In that case, Microsoft's guidance is to try Microsoft Update or contact the organization's help desk.

Verifying the fix

Without source code, the version number is the only confirmation. Check the Excel or Office build (Windows: File > Account > About Excel; Mac: Excel > About Excel) or the installed Office Online Server version, and confirm it is at or above the fixed build listed above. For Microsoft 365 Apps, compare the channel build against aka.ms/OfficeSecurityReleases, because the patched build differs by update channel.

The reviewed advisory documents no interim workaround, so we are not suggesting registry changes, file blocking rules, or other unverified substitutes for the update.

Affected systems and versions

Per the official CNA record, the following ranges are affected. The upper value in each range is exclusive, so that build and later are fixed.

• Microsoft 365 Apps for Enterprise: versions from 16.0.1, with channel-specific fixed builds per Microsoft's Office security release guidance.
• Microsoft Office 365 for Mac: versions from 1.0.0 up to, but not including, 16.115.26110837.
• Microsoft Office LTSC 2021: versions from 16.0.1 up to, but not including, 16.0.14334.21048.
• Microsoft Office LTSC 2024: versions from 16.0.0 up to, but not including, 16.0.17932.21140.
• Microsoft Office LTSC for Mac 2021: versions from 16.0.1 up to, but not including, 16.115.26110837.
• Microsoft Office LTSC for Mac 2024: versions from 16.0.0 up to, but not including, 16.115.26110837.
• Office Online Server: versions from 16.0.0.0 up to, but not including, 16.0.10417.20236.

The documented exploitation scenario is the Excel client sequence of opening a workbook and then converting it to another format. Office Online Server is listed as affected and has a confirmed fix, but the reviewed sources do not describe a separate server-specific exploitation sequence.

Vendor security history

Microsoft's productivity suites are widely used in business. The European Commission's 2025 Teams decision records a preliminary assessment that Microsoft held a dominant position in worldwide SaaS productivity applications for professional use since at least 2017. That shows the ecosystem's significance. It does not indicate how many vulnerable Excel or Office Online Server installations exist.

The Cyber Safety Review Board concluded that the separate 2023 Exchange Online intrusion was preventable and that Microsoft's security culture was inadequate, citing decisions that deprioritized enterprise security investment and rigorous risk management. DHS described the actor involved as assessed to be affiliated with the People's Republic of China. That incident concerned cloud identity and email and has no established connection to this Excel memory corruption bug.

Microsoft launched its Secure Future Initiative in November 2023 as a multiyear effort built around security by design, security by default, and improved operational controls. Its July 2026 progress report states that three objectives reached their target state, three were nearing completion, and twelve made significant progress. These are vendor-reported outcomes. They do not indicate whether any given customer installation has received this fix.

References

• NVD: CVE-2026-118292
• Official CVE record (CVE Services API)
• NVD API record for CVE-2026-118292
• MSRC Security Update Guide: CVE-2026-118292
• Microsoft Support: KB5002946 security update for Office Online Server
• Microsoft Support: KB5002946 description
• Microsoft Download Center: KB5002946
• Microsoft Learn: Release notes for Microsoft Office security updates
• Office Security Releases
• Microsoft Support: How to update Microsoft 365 or Office for Windows
• MITRE CWE 121: Stack based Buffer Overflow
• Qualys: Microsoft Patch Tuesday, November 2026 Security Update Review
• CrowdStrike: November 2026 Patch Tuesday Updates and Analysis
• Senserva: CVE-2026-118292 Office Online Server fix KB5002946
• CSRB: Review of the Summer 2023 Microsoft Exchange Online Intrusion
• DHS: CSRB Releases Report on Microsoft Online Exchange Incident
• Microsoft: Secure Future Initiative
• Microsoft: SFI Progress Report July 2026
• European Commission: Microsoft Teams antitrust decision
• European Commission: Statement of Objections to Microsoft regarding Teams