Overview of CVE-2026-118299: Heap-Based Buffer Overflow in Microsoft Excel AutoFormat Enables Code Execution

Introduction

A heap-based buffer overflow in Microsoft Office Excel, fixed in the November 10, 2026 Patch Tuesday release, can give an attacker code execution with the privileges of whoever opens a crafted spreadsheet and runs AutoFormat on it. The affected product list spans Windows desktop Office, Office for Mac, and Office Online Server, so remediation touches both endpoints and server infrastructure, even though Microsoft reported no exploitation at release.

Microsoft is both the affected vendor and the assigning CNA for CVE-2026-118299. It rates the issue CVSS v3.1 8.8 (High) with a product severity of Important, and its exploitability assessment is Exploitation Less Likely. These labels measure different things, and we keep all three in view below. The NVD record is still under analysis and does not yet carry an independent NIST base score.

Technical information

Root cause

Microsoft classifies the bug as CWE-122: Heap based Buffer Overflow. MITRE defines this weakness as writing beyond the end of a buffer allocated on the heap. As a class, it can crash the process, corrupt adjacent heap memory, or overwrite function pointers in ways that may lead to arbitrary code execution. Those are general consequences of the weakness class. Microsoft has not said which heap object is corrupted or how.

The advisory FAQ says more than the one-line CVE description about where the bug lives. The vulnerable logic runs when a user applies AutoFormat to cells in a crafted spreadsheet, so the fix is in the code that handles AutoFormat on cell data. Microsoft has not disclosed:

• the vulnerable function or module
• the file extension or record structure used in the crafted spreadsheet
• the corrupted object or payload layout
• the type of check added by the fix (for example, a bounds check or a corrected allocation size)

Excel is closed source, so there is no public commit, diff, or root-cause write-up. The fix ships only as updated Office binaries.

CVSS breakdown

Microsoft's published vector components:

• Attack Vector: Network (AV:N). This reflects remote delivery of the file. It does not imply an interaction-free network service exploit.
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R). The user must open the file and apply AutoFormat.
• Scope: Unchanged (S:U)
• Confidentiality, Integrity, Availability: High (C:H/I:H/A:H)
• Base score 8.8, temporal score 7.7, reflecting an Official Fix (RL:O) and Unproven exploit maturity.

The NVD record also carries a CISA SSVC assessment: exploitation: none, automatable: no, technicalImpact: total.

Attack flow

Based on Microsoft's FAQ, the documented exploitation sequence is:

1. The attacker prepares a specially crafted spreadsheet. The specific structure required has not been published.
2. The attacker convinces a target user to open that spreadsheet in an affected Excel version.
3. The user applies AutoFormat to the spreadsheet's cells, which drives Excel's formatting engine into the vulnerable code path and triggers the heap overflow.
4. On successful exploitation, attacker-controlled code runs with the privileges of that user.

This flow has three limits:

• The Preview Pane is not an attack vector. That is consistent with a bug that needs Excel's full formatting engine rather than a document preview.
• The documented outcome is execution at the user's privilege level. Microsoft does not describe an automatic escalation beyond that.
• The reviewed sources do not establish that macros, saving to another format, or simply previewing the file are part of the exploitation path.

Exploitation status at release

At original publication, MSRC marked CVE-2026-118299 as Exploited: No, Publicly disclosed: No, and Exploitation Less Likely. An independent tracker (cve.now) reports no public exploit code tracked and no CISA KEV listing. None of the reviewed material attributes a threat actor, campaign, or victim to this CVE. EPSS data is inconsistent across trackers. Senserva shows it as not scored, while VulDB displays 0.00000 without an EPSS timestamp. Neither figure should be read as zero risk.

Patch information

Microsoft fixed CVE-2026-118299 in its November 10, 2026 Patch Tuesday release. The MSRC advisory sets the CVSS temporal Remediation Level to Official Fix (RL:O), meaning a complete vendor fix is available. In practice, a system is patched once its build number is at or above the fixed build for its product line.

Fixed builds

From the MSRC Security Updates table and NVD's affected version ranges:

• Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140
• Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048
• Office Online Server: 16.0.10417.20236 (KB5002946)
• Microsoft Office 365 for Mac, Office LTSC for Mac 2021 and 2024: 16.115.26110837
• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): depends on update channel (see Office Security Releases)

NVD lists each of these builds as the exclusive upper bound of the affected range. For example, Office LTSC 2021 is affected from 16.0.1 up to, but not including, 16.0.14334.21048. If the installed build is lower, the system is still exposed.

Microsoft 365 Apps has no single build number. Each servicing channel (Current, Monthly Enterprise, Semi Annual) receives its own patched build, published in the Microsoft 365 Apps security update release notes, which explicitly list CVE-2026-118299 under Excel.

Office Online Server: KB5002946

This is the only fix delivered as a separate KB package:

• Package build: 16.0.10417.20236. The release version of Office Online Server must already be installed.
• Cumulative: It replaces the previous security update, KB5002928 (October 2026), and bundles fixes for about 58 Excel-related CVEs, including the neighbouring CVE-2026-118292 through CVE-2026-118302. Microsoft's summary says the update fixes Excel remote code execution and information disclosure vulnerabilities.
• Delivery options: Microsoft Update (automatic), the Microsoft Update Catalog (standalone package, search KB5002946), or the Microsoft Download Center. Follow the installation instructions on the download page.
• Integrity check: The installer wacserver2019-kb5002946-fullfile-x64-glb.exe has SHA256 F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0. Compare this hash before installing a package obtained from a mirror or internal distribution point.
• What changed: Microsoft publishes a CSV of the binaries the update touches, linked from the KB article. It is useful for scoping a binary diff, but it does not describe the code change itself.

KB5002946 applies only to Office Online Server. Do not treat it as the fix for desktop Excel.

Click to Run and Mac editions

The Windows desktop editions (Microsoft 365 Apps and Office LTSC 2021 and 2024) and all Mac editions are patched through their normal update channels, with no separate KB file. Microsoft links them to the Office security update release notes for Windows and the Office for Mac release notes. To confirm the fix, check that the build shown under File > Account > About Excel (Windows) or Excel > About Excel (Mac) is at or above the build listed above.

Microsoft does not document a workaround or configuration change for this CVE, so no registry setting, macro policy, or file filter is established as a substitute for updating.

Affected systems and versions

Per Microsoft's advisory and NVD's affected ranges, the following are vulnerable below the listed builds:

• Microsoft Office LTSC 2024, 32 bit and 64 bit: builds below 16.0.17932.21140
• Microsoft Office LTSC 2021, 32 bit and 64 bit: from 16.0.1 up to, but not including, 16.0.14334.21048
• Microsoft Office LTSC for Mac 2021: builds below 16.115.26110837
• Microsoft Office LTSC for Mac 2024: builds below 16.115.26110837
• Microsoft Office 365 for Mac: builds below 16.115.26110837
• Office Online Server: builds below 16.0.10417.20236
• Microsoft 365 Apps for Enterprise, 32 bit and 64 bit: builds below the channel-specific patched build for the November 10, 2026 security release

Two scoping notes:

• A secondary Senserva summary describes the issue as limited to Mac Office builds, while its own product list includes Windows products and Office Online Server. Microsoft's authoritative matrix confirms the broader scope, and the Mac-only framing should not drive remediation coverage.
• Excel is also available on mobile platforms and the web, but the advisory's product list, not Excel's overall platform availability, defines what is affected.

Vendor security history

The most widely cited independent assessment of Microsoft's security practices in recent years is the Cyber Safety Review Board's review of the summer 2023 Exchange Online intrusion. Microsoft determined that Storm-0558 used an acquired consumer token-signing key to forge tokens and access Exchange Online accounts. The Board found that Microsoft did not detect the key compromise on its own and relied on a customer to spot anomalies. It concluded that Microsoft's security culture was inadequate and required an overhaul, and it called for direct CEO and board attention along with a public reform plan with timelines. That incident involved a different service and has no connection to CVE-2026-118299.

Microsoft's July 2026 Secure Future Initiative progress report describes subsequent changes. These figures are self reported:

• 1.4M unused Entra applications decommissioned
• 93% of critical and high-value build pipelines using centrally governed templates
• 1,989 CVEs published with CWE and CPE annotations

None of these measures establishes that an unpatched Excel installation is protected. For this exposure, the corrective action remains the product-specific update.

References

• NVD: CVE-2026-118299
• CVE Record: CVE-2026-118299
• Microsoft Security Update Guide: CVE-2026-118299
• Security update for Office Online Server: November 10, 2026 (KB5002946)
• Zero Day Initiative: The November 2026 Security Update Review
• Release notes for Microsoft Office security updates
• Office Security Releases
• Release notes for Office for Mac
• NVD API record for CVE-2026-118299
• MITRE CWE-122: Heap based Buffer Overflow
• cve.now: CVE-2026-118299
• VulDB: CVE-2026-118299
• Senserva: CVE-2026-118299
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft SFI Progress Report, July 2026
• Microsoft 2026 Annual Report
• Microsoft Excel product page
• BleepingComputer: Microsoft November 2026 Patch Tuesday