Introduction
A heap-based buffer overflow in Microsoft Office Excel, fixed in Microsoft's November 10, 2026 Patch Tuesday release, can give an attacker code execution once a user opens a specially crafted file. The affected product list reaches well past desktop Excel on Windows, covering Mac editions and Office Online Server, so a response scoped only to workstations would leave a listed server product unpatched.
Microsoft assigns the issue a CVSS 3.1 base score of 8.8 (High) and its own maximum severity rating of Critical. At publication, Microsoft reported no public disclosure and no observed exploitation. Below we summarize what the public record establishes, what it does not, and how fixes map to each product line.
Technical information
Root cause
The weakness is classified as CWE-122, Heap based Buffer Overflow. MITRE defines this class as a buffer overflow in which the overwritten buffer lives in memory allocated on the heap, typically through an allocation routine such as malloc(). As general class background, MITRE notes that heap overflows can overwrite function pointers and redirect execution to attacker-controlled code, modify memory, and bypass protection mechanisms.
That is where the public detail ends. Excel is closed source, no public diff or commit exists, and Microsoft has not published root cause details. The advisory does not disclose:
- The Excel parser, function, or file structure responsible
- The required file extension or the malformed field
- The memory layout or how execution is ultimately achieved
- The account context under which code would run
We have no vulnerable code snippet to show, and we are not going to reconstruct one. For a CWE-122 bug in a file parser, fixes usually add or correct size checks before file data is copied into a heap buffer, or ensure the buffer is allocated at the size the record actually needs. Neither approach has been publicly confirmed for this CVE, so treat that as bug-class background rather than a description of the patch.
CVSS breakdown
The base vector, from the Microsoft-supplied NVD record, is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack Vector: Network. Microsoft classifies the attack as remotely deliverable.
- Attack Complexity: Low.
- Privileges Required: None. The attacker needs no prior privileges under the scoring model.
- User Interaction: Required. The advisory FAQ identifies opening the crafted file as the required action.
- Scope: Unchanged.
- Confidentiality, Integrity, Availability: High. Serious disclosure, modification, and loss of availability are all potential outcomes.
A Network attack vector does not remove the required file-opening step. Microsoft also publishes a temporal score of 7.7 using the extended metrics:
E:U/RL:O/RC:C
This reflects exploit maturity Unproven and remediation level Official Fix. The temporal score supplements the 8.8 base score and does not replace it.
Attack flow
Based on Microsoft's documented scenario, exploitation proceeds as follows:
- Preparation. The attacker builds a specially crafted file designed to trigger the heap overflow in Excel. The exact file format and malformed structure are not disclosed.
- Delivery. The file reaches the target over a network. The CVSS model rates the vector as Network, but the advisory does not name a specific delivery channel.
- User action. The target user opens the file. Microsoft explicitly states that the Preview Pane is not an attack vector, so receiving or previewing the file is not described as sufficient. The advisory does not state that enabling macros is required.
- Memory corruption. Excel processes the malformed content and writes beyond the bounds of a heap-allocated buffer.
- Code execution. Successful exploitation results in remote code execution, with High potential impact to confidentiality, integrity, and availability. The resulting execution account is not documented.
Exploitation status
Microsoft's exploitability assessment at original publication reads:
- Publicly disclosed: No
- Exploited: No
- Assessment: Exploitation Less Likely
- Exploit maturity: Unproven (no publicly available exploit code, or theoretical exploitation)
NVD's accompanying CISA SSVC entry records Exploitation: none, Automatable: no, and Technical Impact: total. No threat actor, campaign, malware family, file hashes, or attacker infrastructure is identified in the Microsoft or NVD records. The vulnerability was reported through coordinated disclosure by researchers from UIUC and KAIST Hacking Lab, which is consistent with the absence of public disclosure before the patch shipped. NVD lists the record as Undergoing Analysis, with [email protected] as the CVSS source.
Patch information
Microsoft fixed CVE-2026-118297 in its November 10, 2026 Patch Tuesday release. The MSRC advisory sets RL:O (Remediation Level: Official Fix), meaning a full vendor fix is available rather than a workaround or hotfix. The fix is a binary update. To confirm protection, check that each install has reached or passed the fixed build number for its product line.
Fixed builds by product
- Office Online Server: vulnerable from 16.0.0.0 up to (not including) 16.0.10417.20236. Fixed in 16.0.10417.20236 via KB5002946.
- Microsoft Office LTSC 2021 (32 bit and 64 bit): vulnerable from 16.0.1 up to (not including) 16.0.14334.21048. Fixed in 16.0.14334.21048.
- Microsoft Office LTSC 2024 (32 bit and 64 bit): vulnerable from 16.0.0 up to (not including) 16.0.17932.21140. Fixed in 16.0.17932.21140.
- Microsoft 365 Apps for Enterprise (32 bit and 64 bit): all channels before the November security build. Fixed builds vary by channel; see Office security release notes.
- Microsoft Office 365 for Mac, Office LTSC for Mac 2021, Office LTSC for Mac 2024: vulnerable before 16.115.26110837. Fixed in 16.115.26110837.
Office Online Server: KB5002946
Office Online Server renders workbooks on the server, so it has its own servicing package. Per Microsoft's KB article:
- KB5002946 is build 16.0.10417.20236. The release version of Office Online Server must already be installed before applying it.
- It replaces the earlier security update KB5002928, so patch management tools should show 5002928 as superseded.
- It is a cumulative, Excel-focused rollup. It lists CVE-2026-118297 among dozens of other Excel remote code execution and information disclosure CVEs fixed in the same package, including neighbouring IDs CVE-2026-118292 through CVE-2026-118302. Installing it addresses the whole group.
- Distribution channels are Microsoft Update (automatic when enabled), the Microsoft Update Catalog (standalone package), and the Microsoft Download Center (download ID 108899).
- The KB article does not provide a CVE-specific restart instruction or a separate workaround.
To verify package integrity, Microsoft publishes the following hash:
File: wacserver2019-kb5002946-fullfile-x64-glb.exe SHA256: F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0
Click to Run and Mac clients
Microsoft 365 Apps and the Office LTSC editions use Click to Run servicing, so the fix arrives as a channel build update rather than a standalone KB. MSRC does not give one build number for Microsoft 365 Apps because each update channel (Current, Monthly Enterprise, Semi Annual) receives its own patched build.
On Windows, users can open any Microsoft 365 app, go to File > Account, and choose Update Options > Update Now (clicking Enable Updates first if needed). If Update Options is missing, the install is either volume licensed or managed through Group Policy.
For Mac, all three affected SKUs share the fixed build 16.115.26110837, delivered through Microsoft AutoUpdate. In an Office app, select Help > Check for Updates, enable Automatically keep Microsoft apps up to date, then select Update. Mac App Store installs update through Updates > Update All.
What the patch does not change
The advisory publishes no separate workaround, macro configuration remedy, or file-blocking rule. Nothing in the sources establishes that disabling macros, changing Preview Pane settings, or installing an unrelated Office package remediates this CVE. The product-matched security update is the documented remedy.
Affected systems and versions
The following products and version ranges are affected, per the MSRC Security Update Guide and the CNA data on NVD:
Windows (Click to Run)
- Microsoft 365 Apps for Enterprise, 32 bit and x64: all channels before the November 2026 security build
- Microsoft Office LTSC 2021, 32 bit and 64 bit: 16.0.1 up to (not including) 16.0.14334.21048
- Microsoft Office LTSC 2024, 32 bit and 64 bit: 16.0.0 up to (not including) 16.0.17932.21140
Mac
- Microsoft Office 365 for Mac: before 16.115.26110837
- Microsoft Office LTSC for Mac 2021: before 16.115.26110837
- Microsoft Office LTSC for Mac 2024: before 16.115.26110837
Server
- Office Online Server: 16.0.0.0 up to (not including) 16.0.10417.20236
The Office Online Server listing means this is not only a desktop issue. The listing does not, however, establish an exploit path through automatic, unauthenticated server requests. The only documented trigger remains a user opening a crafted file.
Vendor security history
Microsoft is the affected vendor and assigning CNA. For context on scale, the European Commission's June 2024 Statement of Objections gives a preliminary finding that Microsoft is dominant worldwide in SaaS productivity applications for professional use, and identifies Excel as one of its core productivity applications. That finding concerns the productivity suite market, not installed base figures for vulnerable Excel versions.
The most relevant independent assessment of Microsoft's security track record is the Cyber Safety Review Board's review of the 2023 Exchange Online intrusion. The Board found that the intrusion was preventable and should never have occurred, concluded that Microsoft's security culture was inadequate and required an overhaul, and identified failures involving cryptographic key compromise detection, security decisions, and inaccurate public statements. That incident was a cloud identity and Exchange event, and it is not related to this Excel vulnerability.
In May 2024, Microsoft expanded its Secure Future Initiative in response, built on three principles: secure by design, secure by default, and secure operations. The initiative links part of senior leadership compensation to security progress, and Microsoft reports enforcing multifactor authentication by default across more than one million Microsoft Entra ID tenants and removing 730,000 applications that fell outside lifecycle or compliance requirements. These are Microsoft's reported outcomes, not independent verification. For this CVE, the decision-relevant evidence remains the advisory and its product update mappings.
References
- MSRC Security Update Guide: CVE-2026-118297
- NVD: CVE-2026-118297
- NVD API record for CVE-2026-118297
- Microsoft Support: Security update for Office Online Server, November 10, 2026 (KB5002946)
- Microsoft Download Center: KB5002946
- Action1: Patch Tuesday November 2026
- Microsoft Learn: Release notes for Microsoft Office security updates
- Microsoft Learn: Release notes for Office for Mac
- Microsoft Support: How to update Microsoft 365 or Office for Windows
- Microsoft Support: Update Office for Mac automatically
- MITRE CWE-122: Heap based Buffer Overflow
- VulDB: CVE-2026-118297
- Senserva: CVE-2026-118297 Office Online Server fix KB5002946
- CSRB: Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft Security Blog: Expanding Microsoft's Secure Future Initiative
- European Commission: Statement of Objections to Microsoft
- EUR Lex: Summary of Commission Decision of 12 September 2025 (Microsoft Teams)
