Brief Summary: Microsoft Excel CVE-2026-118295 Stack-Based Buffer Overflow Enabling Remote Code Execution

Introduction

The documented exploitation path for CVE-2026-118295 asks one thing of the victim, which is to open a single crafted workbook. Microsoft fixed this memory corruption flaw in Microsoft Office Excel in its November 10, 2026 security release. The affected product list spans Windows desktop Office, Office for Mac, and Office Online Server, so remediation touches several servicing models at once. Each model has its own fixed build and its own deployment caveats.

Microsoft is both the affected vendor and the assigning CNA. It rates the issue Important on its own severity scale, while the CVSS 3.1 base score is 8.8 (High). The two ratings come from different scales and do not conflict. At original publication, Microsoft reported the vulnerability as not exploited and not publicly disclosed, with an exploitability assessment of Exploitation Less Likely.

Technical information

Root cause as disclosed

Microsoft's description is brief: a stack-based buffer overflow in Excel allows an unauthorized attacker to execute code over a network. The advisory's exploitation FAQ adds the main constraint: "This attack requires a user to open a specially crafted file from the attacker to initiate remote code execution." Microsoft also states that the Preview Pane is not an attack vector.

Microsoft records two weaknesses for this bug:

• CWE-190 (Integer Overflow or Wraparound): a calculation overflows or wraps even though the surrounding logic assumes the result will stay larger than the original value. The result can instead become small or negative.
• CWE-121 (Stack based Buffer Overflow): data is written beyond the bounds of a buffer allocated on the stack. MITRE lists crashes and arbitrary code execution among the generic consequences.

MITRE explains that integer overflow can lead to insufficient memory allocation and thereby contribute to a buffer overflow. This pairing is common in file parser bugs. In that pattern, a size or count value read from the file goes through arithmetic that wraps around and produces a small or otherwise wrong length. The parser then trusts that length when copying data into a fixed-size buffer on the stack.

Microsoft has not published the precise causal relationship between the two CWEs for this CVE, so the pattern above is a reasonable reading of the recorded weaknesses rather than a confirmed reconstruction. Fixes for this class of bug usually add an overflow check on the arithmetic and a bounds check on the final length before the copy. That too is an educated guess, because Excel is closed source and no public diff exists.

What has not been disclosed

The advisory does not identify any of the following:

• the vulnerable function or component
• the required file extension or format
• the malformed record structure
• a payload or detailed memory corruption sequence
• the execution account or any follow-on privilege escalation

The more elaborate macro-recording workflows documented for some other Office vulnerabilities should not be attributed to this CVE. Including Office Online Server in the affected list establishes remediation scope. It does not establish a separate unauthenticated, request-based exploit against the server.

CVSS breakdown

The full Microsoft vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

The vector yields a base score of 8.8 and a temporal score of 7.7. NVD displays Microsoft's CNA score and has not published an independent assessment.

• Attack Vector: Network. This is the remote attack classification.
• Attack Complexity: Low. The score definition includes no specialized access conditions.
• Privileges Required: None. The attacker needs no prior authorization.
• User Interaction: Required. A user must open the file.
• Scope: Unchanged. Impact stays within the same security authority.
• Confidentiality, Integrity, Availability: High. The potential impact to affected resources is severe.
• Exploit Code Maturity: Unproven. Under Microsoft's definition, no exploit code is publicly available or the exploit is theoretical.
• Remediation Level: Official Fix. A complete vendor solution is available.

The Network and Low complexity values do not cancel the explicit requirement that a user open the file.

Attack flow

Based only on what Microsoft has disclosed, the sequence is:

1. The attacker prepares a specially crafted file designed to trigger the overflow when Excel processes it.
2. The attacker delivers the file to a target user. Microsoft does not specify the delivery channel.
3. The user opens the file in a vulnerable Excel build. Viewing it in the Preview Pane is not sufficient.
4. While Excel opens and parses the workbook, the flaw, recorded as an integer overflow and a stack-based buffer overflow, corrupts stack memory.
5. The attacker achieves code execution. Microsoft has not specified the resulting execution context.

Patch information

Microsoft fixed CVE-2026-118295 in its November 10, 2026 security release. The MSRC advisory sets the Remediation Level to RL:O (Official Fix). No separate workaround or hotfix exists, and the fix ships only as updated product builds. The advisory places the trigger in file opening, so the fix lands in the code Excel runs when it opens and parses a workbook.

Fixed builds

• Microsoft 365 Apps for Enterprise (32-bit and 64-bit): Click to Run channel builds listed at the Office security release notes
• Microsoft Office LTSC 2024 (32-bit and 64-bit): 16.0.17932.21140
• Microsoft Office LTSC 2021 (32-bit and 64-bit): 16.0.14334.21048
• Microsoft Office 365 for Mac, Office LTSC for Mac 2021 and 2024: 16.115.26110837
• Office Online Server: 16.0.10417.20236 (KB5002946)

NVD records each affected range as ending just before these builds. Any build at or above the listed number contains the fix.

How the fix reaches each platform

• Microsoft 365 Apps: Click to Run installs update themselves through their servicing channel. No standalone KB exists, so the patched build depends on the channel. Check the installed build against the Office security release page rather than applying one build number across the whole estate.
• Office LTSC 2021/2024 and Mac: these have fixed build numbers, so verification is a direct comparison of the installed build against the list above.

Office Online Server: KB5002946

Office Online Server renders Excel files on the server, so it needs its own package. KB5002946 is a cumulative Excel security update that covers many Excel CVEs from this release, including CVE-2026-118295.

• Build: 16.0.10417.20236
• Replaces: the October package KB5002928, so installing it also brings in the earlier fixes
• Requirement: the release version of Office Online Server must already be installed
• Availability: Microsoft Update, the Microsoft Update Catalog, or the Download Center (package wacserver2019-kb5002946-fullfile-x64-glb.exe)
• SHA256: F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0

The KB mentions Microsoft Update availability, but Microsoft's Office Online Server deployment guide warns that automatically applying updates is unsupported. Doing so can leave users unable to view or edit documents and may require rebuilding the farm.

• Single-server farm: record the existing farm configuration, remove the server from the farm, apply the update, then recreate the farm with the appropriate configuration. Office Online is unavailable during the update, so Microsoft recommends scheduling it outside business hours.
• Multiple-server farm: remove one server from the load balancer and farm, update it, create an updated farm, and move the remaining servers through the same process. Shift traffic once enough updated servers can carry the current load. This preserves document access during the transition.

Notes on supplemental guidance and sources

Microsoft's general Office guidance recommends staying in Protected View unless editing is needed and the file source is trusted. That guidance does not reference this CVE, and nothing establishes that Protected View blocks this exploit. The supported corrective action is the product update.

One upstream source linked this CVE to Red Hat gstreamer1-plugins-good errata. That link came from confusion with a different, similarly numbered CVE and is unrelated to this Excel vulnerability.

Affected systems and versions

The CVE record lists seven product families. Each upper boundary is exclusive.

• Microsoft 365 Apps for Enterprise: from 16.0.1. The fixed boundary depends on the channel, and the registry points to the Office security releases.
• Microsoft Office 365 for Mac: from 1.0.0 up to, but not including, 16.115.26110837
• Microsoft Office LTSC 2021: from 16.0.1 up to, but not including, 16.0.14334.21048
• Microsoft Office LTSC 2024: from 16.0.0 up to, but not including, 16.0.17932.21140
• Microsoft Office LTSC for Mac 2021: from 16.0.1 up to, but not including, 16.115.26110837
• Microsoft Office LTSC for Mac 2024: from 16.0.0 up to, but not including, 16.115.26110837
• Office Online Server: from 16.0.0.0 up to, but not including, 16.0.10417.20236

The Windows Microsoft 365 Apps and LTSC entries cover both 32-bit and x64 systems. Being on this list defines remediation scope. It does not mean the exploitation workflow is identical across every desktop and server configuration.

Vendor security history

The Cyber Safety Review Board describes Microsoft's products and services as ubiquitous and stresses the responsibility that comes with that position. In its review of the 2023 Exchange Online intrusion, the Board found that the attack succeeded through a cascade of Microsoft security failures. It judged the intrusion preventable and Microsoft's security culture inadequate. Its findings included Microsoft's failure to independently detect the compromise of critical cryptographic material and delays in correcting inaccurate public statements. That incident is historical cloud security context. It is not evidence that the same actor targets this Excel bug.

Microsoft's July 2026 Secure Future Initiative report claims 99.97% phishing-resistant MFA coverage for users and devices and remediation of more than 550,000 critical and high-risk open-source vulnerability instances. Microsoft frames security as a continuous effort, and independent reporting notes that product complexity keeps producing new flaws. For a sense of volume, the Zero Day Initiative's November 2026 review counted 64 Excel CVEs and 65 Word CVEs in this release alone. That figure helps with patch planning, but it is not evidence that each listed CVE is exploited.

For exploitation status, CISA's Known Exploited Vulnerabilities catalog is the authoritative source on in-the-wild exploitation. The available material does not show a KEV listing for this CVE.

References

• NVD: CVE-2026-118295
• CVE Record: CVE-2026-118295
• Microsoft Security Update Guide: CVE-2026-118295
• Microsoft Support: KB5002946
• Security update for Office Online Server: November 10, 2026 (KB5002946)
• Rapid7 Vulnerability Database: CVE-2026-118295
• Release notes for Microsoft Office security updates
• Release notes for Office for Mac
• Apply software updates to Office Online Server
• Zero Day Initiative: The November 2026 Security Update Review
• CWE-121: Stack based Buffer Overflow
• CWE-190: Integer Overflow or Wraparound
• What is Protected View?
• CISA Known Exploited Vulnerabilities Catalog
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft SFI Progress Report, July 2026
• Cybersecurity Dive: Inside Microsoft's security transformation
• Microsoft 2026 Annual Report
• VulDB: CVE-2026-118295
• Senserva: CVE-2026-118295