Brief Summary: CVE-2026-118293, Microsoft Excel Out-of-Bounds Read Leading to Remote Code Execution

Introduction

According to Microsoft, a crafted Excel workbook is enough to run attacker code with the victim's privileges on an unpatched system, provided the user opens it and agrees to update its external links. The fix shipped in the November 10, 2026 security release and covers seven Office product families, including Mac Office and Office Online Server, so the remediation scope is wider than Windows Excel desktops.

NVD records a CVSS 3.1 base score of 8.8 (High) for CVE-2026-118293, while Microsoft assigns its own severity label of Important. These come from different rating systems and do not contradict each other. The supplied CVE data lists the vendor as "Unknown", but the CVE record identifies Microsoft as both vendor and assigning CNA.

Technical Information

Root cause

Microsoft's description reads: out of bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. The CVE record maps the issue to two weaknesses:

• CWE-125, Out of bounds Read: MITRE defines this as reading data past the end, or before the beginning, of the intended buffer. On its own, a read error is neither a write primitive nor a full explanation of code execution.
• CWE-191, Integer Underflow: a subtraction whose result falls below the minimum value the integer type can hold, producing an incorrect result. It can affect signed or unsigned integers, and MITRE notes the resulting state can sometimes lead to further memory corruption or arbitrary code execution.

Taken together, these two classifications describe a common parser bug pattern. A length or offset read from the file is reduced by a subtraction, such as a header size or a field that has already been consumed. If the value is smaller than what is being subtracted, an unsigned result wraps around to a very large number. The parser then trusts that number as a valid size and reads past the end of its buffer.

Excel is closed source and Microsoft has not published its change, so this explains the bug class, not the actual code. The advisory does not disclose a workbook sample, the affected function, the arithmetic operands, the memory layout, or how the read is turned into code execution. Because the documented trigger involves external links, the faulty arithmetic is plausibly in code that handles workbook or linked data structures, but Microsoft has not confirmed which component is involved.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector: Network. The rating allows for remote reachability.
• Attack Complexity: Low. No special access conditions are required.
• Privileges Required: None. The attacker needs no prior authorization.
• User Interaction: Required. The victim must take action.
• Scope: Unchanged. Impact stays within the same security authority.
• Confidentiality, Integrity, Availability: High. These describe potential impact, not observed losses.

The Network rating does not cancel the User Interaction requirement. The attacker needs no credentials, but the victim must still act.

Attack flow

Based on Microsoft's FAQ, the documented sequence is:

1. The attacker prepares a specially crafted workbook targeting an affected Excel version.
2. The attacker convinces a user to open the workbook. The advisory does not specify a delivery channel.
3. The user opens the workbook in an affected version of Excel.
4. The user enables updates to the workbook's external links.
5. Excel processes the malformed data. Per the CWE mapping, this involves an integer underflow and an out-of-bounds read. Microsoft has not published the internal sequence connecting the two.
6. On successful exploitation, code runs with the privileges of the logged-on user.

Microsoft explicitly states that the Preview Pane is not an attack vector. The documented path depends on two deliberate user actions: opening the file and enabling link updates. It does not describe a macro-based or service-based attack.

Workbook link settings and their limits

The second user action, enabling external link updates, corresponds to a documented Excel setting: File > Options > Trust Center > Trust Center Settings > External Content > Security settings for Workbook Links. The default is Prompt user on automatic update for Workbook Links; Disable automatic update of Workbook Links is also available. Microsoft labels enabling automatic updates for all workbook links as not recommended.

These settings bear on the documented attack path, but the advisory does not present them as a validated, complete workaround for this CVE. Microsoft's linked workbook guidance also notes that clearing Ask to update automatic links can cause links to update automatically without any message. A warning that stops appearing does not mean the exposure has been removed.

Exploitation status at publication

At original publication, Microsoft recorded Publicly disclosed: No, Exploited: No, and Exploitation Less Likely, with exploit code maturity rated Unproven. VulDB shows the CVE as not listed in CISA KEV. We found no threat actor, campaign, malware family, or incident indicators tied to this CVE in the reviewed sources.

The Zero Day Initiative's November 2026 review flags CVE-2026-124194, an Outlook spoofing issue, as exploited. That is a separate product and identifier, and its status does not apply to this Excel bug.

Jeongmin Choi (@lmksecurity) is credited with reporting CVE-2026-118293 through coordinated disclosure.

Patch Information

Microsoft fixed CVE-2026-118293 in its November 10, 2026 security release, the same day the advisory was published. The MSRC advisory sets the CVSS temporal Remediation Level to Official Fix, meaning a complete vendor solution is available. Excel is closed source, so there is no public commit or diff to review. All evidence for the fix comes from Microsoft's advisory, KB articles, and release notes.

What the fix most likely changes

Fixes for the CWE-125 and CWE-191 bug pattern usually do one or more of the following:

• check that a value is at least as large as what is being subtracted before doing the subtraction
• reject records whose stated length is larger than the data actually left in the stream
• use checked or saturating arithmetic so a wrapped value cannot be used as a size

Microsoft has not published its exact change, so treat this as background on the bug class, not as a description of the patch.

Fixed builds (MSRC Security Updates table)

• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): Click to Run channel builds, listed in the Office security release notes
• Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140 (Version 2408)
• Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048 (Version 2108)
• Office Online Server: 16.0.10417.20236, KB5002946
• Office 365 for Mac, Office LTSC for Mac 2024 and 2021: 16.115 (Build 26110837)

Microsoft 365 Apps channel builds

The November 10 release notes for Microsoft 365 Apps security updates list CVE-2026-118293 with these builds:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: 2610 (20527.20194), 2609 (20430.20264), or 2608 (20326.20320)
• Semi Annual Enterprise Channel: 2610 (20527.20192), 2609 (20430.20262), or 2608 (20326.20318)
• Office 2024 and 2021 Retail: Version 2610 (Build 20527.20196)

Compare each installation against the build for its own servicing channel, not against an LTSC build number or one from another channel. The Office for Mac release notes for Version 16.115 (Build 26110837) also list this CVE under Excel security updates.

How the fix is delivered

• Click to Run (Microsoft 365 Apps, LTSC, Retail): the fix ships as a normal channel update. Confirm the installed build is at or above the build listed for your channel.
• Mac: update to 16.115 or later through Microsoft AutoUpdate or the App Store.
• Office Online Server: the fix is in KB5002946, a cumulative update for the Excel component. It also fixes several other Excel remote code execution and information disclosure CVEs from the same month. It replaces the earlier update KB5002928 and requires the release version of Office Online Server. It is published through Microsoft Update, as a standalone package in the Microsoft Update Catalog, and in the Download Center as wacserver2019-kb5002946-fullfile-x64-glb.exe with SHA256 F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0.

For Office Online Server, Microsoft's servicing documentation states that automatic updating is not supported and describes a farm procedure. For a single-server farm, remove the server from the farm, apply the update, and recreate the farm. For multiple servers, start by removing a server from the load balancer pool and the farm, update it, and build an updated farm. Restart if prompted. Plan this separately from desktop patching.

Affected Systems and Versions

NVD and the CVE record list the following affected ranges. In each case, the upper boundary is the fixed version and is not included in the affected range.

• Microsoft 365 Apps for Enterprise: from 16.0.1, fixed by the applicable Office security release for the deployed channel (see channel builds above)
• Microsoft Office 365 for Mac: from 1.0.0 up to, but not including, 16.115.26110837
• Microsoft Office LTSC 2021: from 16.0.1 up to, but not including, 16.0.14334.21048
• Microsoft Office LTSC 2024: from 16.0.0 up to, but not including, 16.0.17932.21140
• Microsoft Office LTSC for Mac 2021: from 16.0.1 up to, but not including, 16.115.26110837
• Microsoft Office LTSC for Mac 2024: from 16.0.0 up to, but not including, 16.115.26110837
• Office Online Server: from 16.0.0.0 up to, but not including, 16.0.10417.20236

The documented exploitation path requires a user to open a crafted workbook and enable external link updates. On systems where Workbook Links are set to update automatically without prompting, one of those two user decisions is already gone.

Vendor Security History

The Cyber Safety Review Board describes Microsoft's products as ubiquitous and critical to essential services. The CSRB's review of the Storm-0558 intrusion documents how Exchange Online mailboxes were compromised in May 2023, affecting individuals across 22 organizations. The Board concluded that Microsoft's operational and strategic decisions collectively reflected a culture that deprioritized enterprise security investment and rigorous risk management. It also criticized Microsoft for delaying corrections to inaccurate public statements about the incident.

The same review records concrete remediation: Microsoft revoked the signing key's ability to sign tokens, changed how Exchange Online accepted tokens, and fixed the flaw that let consumer keys access enterprise data. Microsoft's July 2026 Secure Future Initiative report describes later improvements, including 99.97% user and device coverage for phishing-resistant MFA and removal of public access from 732,000 resources. These figures are reported by Microsoft and have not been independently validated.

Neither the CSRB findings nor the SFI report says anything specific about this Excel CVE. The most useful evidence for CVE-2026-118293 is the advisory, the affected version ranges, and the installed build on each system.

References

• NVD: CVE-2026-118293
• CVE Record: CVE-2026-118293
• Microsoft Security Update Guide: CVE-2026-118293
• Microsoft Support: KB5002946
• Release notes for Microsoft Office security updates
• Release notes for Office for Mac
• Download Center: Security Update for Office Online Server (KB5002946)
• Apply software updates to Office Online Server
• Block or unblock external content in Office documents
• Control the startup message about updating linked workbooks
• MITRE CWE-125: Out of bounds Read
• MITRE CWE-191: Integer Underflow
• Zero Day Initiative: The November 2026 Security Update Review
• VulDB: CVE-2026-118293
• CISA Known Exploited Vulnerabilities feed
• Senserva: CVE-2026-118293 Office Online Server fix KB5002946
• CSRB: Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft Secure Future Initiative Progress Report, July 2026
• Microsoft 2026 Annual Report