Introduction
Microsoft's November 10, 2026 Patch Tuesday release fixed a heap-based buffer overflow in Excel that can lead to code execution with the privileges of whoever triggers it. The affected code ships in Windows and Mac Office clients as well as Office Online Server, so the remediation work spans desktop update channels and server farm maintenance windows. The server-side update also comes with deployment caveats worth knowing before you schedule it.
This post summarizes what Microsoft and NVD have published about CVE-2026-118302: the weakness class, the documented attack flow, the fixed builds, and the operational details of the Office Online Server package. We stick to what the sources say and flag clearly where we are inferring.
Technical information
Classification and scoring
Microsoft describes CVE-2026-118302 as a heap-based buffer overflow in Microsoft Office Excel that allows an unauthorized attacker to execute code over a network. The weakness is CWE-122. NVD records publication at 2026-11-10T19:19:43.947 with [email protected] as the source, and at the time of writing the record is marked Undergoing Analysis.
The issue carries two severity labels, and both are worth preserving when you communicate risk internally:
- CVSS v3.1 base score: 8.8, High
- Microsoft maximum severity rating: Important (not Critical)
The base vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack Vector: Network, so the attack is classified as remotely deliverable.
- Attack Complexity: Low, with no specialized conditions beyond the modeled prerequisites.
- Privileges Required: None, so the attacker needs no prior authorization.
- User Interaction: Required, so a user must take part in the exploitation sequence.
- Scope: Unchanged, so impact stays within the same security authority.
- Confidentiality, Integrity, Availability: High.
Microsoft also publishes a temporal score of 7.7, with exploit code maturity set to Unproven and remediation level set to Official Fix (RL:O). The Official Fix tag is the reason the temporal score drops below the 8.8 base.
Root cause
MITRE defines CWE-122 as a condition where a buffer allocated on the heap is overwritten past its end. Generic consequences of the class include crashes and arbitrary code execution, for example through corruption of function pointers stored near the overflowed allocation. Those consequences describe the weakness class in general. No reconstruction of Excel's internals has been disclosed.
What Microsoft does tell us is where the vulnerable code path lives. According to the advisory FAQ, the overflow is reached when a user creates a Forecast Sheet with modified forecast options from a crafted workbook. That places the bug in the code that reads forecast option data and copies it into heap buffers.
Microsoft has not published a vulnerable function name, source location, memory layout, triggering workbook structure, exploit payload or required file extension. The advisory also does not establish a macro requirement. Excel is closed source, so there is no public commit or diff. Fixes for this bug class typically add a size or length check before copying data into a heap allocation, or size the allocation to what the input actually needs. That is our inference about the likely shape of the fix. Microsoft has not stated it.
Attack flow
Based on the MSRC advisory, the documented sequence is:
- The attacker prepares a specially crafted Excel workbook and delivers it to the target (the network vector in CVSS terms).
- The target opens the workbook in an affected Excel version.
- The target creates a Forecast Sheet with modified forecast options, which drives Excel into the vulnerable forecast handling code.
- Data from the crafted workbook is written beyond the bounds of a heap buffer.
- On successful exploitation, attacker code runs with the target user's privileges.
Two boundaries matter here. First, Microsoft explicitly states that the Preview Pane is not an attack vector, so simply receiving or previewing the file does not reach the vulnerable code. Second, the documented outcome is execution at the user's privilege level. The advisory does not describe elevation to administrator or SYSTEM.
Reading AV:N alongside UI:R
The network attack vector does not remove the user interaction requirement, and the Forecast Sheet step is a more specific requirement than "open a file". The NVD record includes a CISA Coordinator SSVC assessment that helps frame this:
- Exploitation: none
- Automatable: no
- Technical impact: total
CISA's SSVC guidance treats exploitation as a statement about present state rather than future likelihood, and a value of none means no evidence of active exploitation and no public proof of concept. Total technical impact, no reported exploitation and a non-automatable, interaction-dependent path are consistent with one another. CISA also cautions that automatable "no" does not prove automation is impossible in every scenario.
Exploitation status
At original publication Microsoft reported the vulnerability as not publicly disclosed, not exploited, and Exploitation Less Likely. No threat actor, campaign, malicious workbook hash, command and control infrastructure or exploit-specific detection rule is identified in the Microsoft or NVD records. These assessments are tied to the date they were made and are not permanent properties of the bug.
Microsoft credits Jeongmin Choi (@lmksecurity), Jmini and Minjea Park with reporting the issue through coordinated disclosure.
Patch information
Microsoft fixed CVE-2026-118302 in its November 10, 2026 Patch Tuesday release, and MSRC rates the remediation level as Official Fix (RL:O). The fix exists only inside the binary updates for each Office product.
Fixed builds by product
All updates below were released on November 10, 2026. Any build lower than the one listed is vulnerable.
- Microsoft 365 Apps for Enterprise (32-bit and 64-bit): channel-specific builds listed at Office security release notes. The advisory gives no single numeric build for this product.
- Microsoft Office LTSC 2024 (32-bit and 64-bit):
16.0.17932.21140 - Microsoft Office LTSC 2021 (32-bit and 64-bit):
16.0.14334.21048 - Office Online Server: KB5002946, build
16.0.10417.20236 - Microsoft Office 365 for Mac, Office LTSC for Mac 2021 and 2024:
16.115.26110837
Avoid substituting builds copied from a different Office product or from an adjacent Excel CVE.
The Office Online Server package (KB5002946)
Microsoft 365 Apps and the Mac builds receive the fix through their normal update channels. Office Online Server is patched separately with the standalone KB5002946 update:
- It is a cumulative Excel rollup rather than a single-CVE hotfix. It addresses CVE-2026-118302 alongside dozens of other Excel remote code execution and information disclosure CVEs from the same release, such as CVE-2026-118292 through CVE-2026-118301 and the CVE-2026-1187xx series.
- It replaces the October update KB5002928, so servers that install KB5002946 also receive all earlier Excel fixes.
- The release version of Office Online Server must already be installed.
- It is distributed through Microsoft Update, the Microsoft Update Catalog (search
KB5002946), or the Download Center (download ID108899).
To verify the download, the installer name and published SHA256 hash are:
wacserver2019-kb5002946-fullfile-x64-glb.exe SHA256: F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0
Microsoft also publishes a CSV listing every file the package changes. For researchers, that list is the starting point for locating the patched Excel calculation binaries and diffing them before and after the patch.
Deploying to Office Online Server
The KB article contains generic automatic update wording, but Microsoft's dedicated Office Online Server deployment guide states that automatic updates are unsupported. It warns that automatic application can break document viewing or editing and may require rebuilding the farm. Follow the farm procedure instead:
- Single-server farm: remove the server from the farm, install the update, restart if prompted, and recreate the farm with the original configuration parameters. The service is unavailable during this process, so Microsoft recommends scheduling it outside business hours.
- Multiple-server farm: remove servers from the load balancer and farm, create an updated farm, and move the remaining servers through the update process.
Updating clients
- Windows: open an Office application and choose File > Account > Update Options > Update Now, selecting Enable Updates first if necessary. Where Update Options is absent because of volume licensing or organizational policy, use Microsoft Update or your help desk process.
- Mac: use Help > Check for Updates to launch Microsoft AutoUpdate, or push Microsoft's application update packages through existing deployment tooling. The Mac release notes we reviewed did not yet list build
16.115.26110837, while the CVE advisory explicitly does.
Confirming a system is patched
Compare the installed build to the list above. For Click to Run installs, check File > Account > About Excel. On Office Online Server, confirm KB5002946 is installed or that the build is 16.0.10417.20236. For Microsoft 365 Apps, check the channel-specific build at the OfficeSecurityReleases link, since channels do not share one build number.
No CVE-specific workaround is published. MITRE's generic CWE-122 guidance (bounds checking, input validation, safer library functions) applies to software development and is not a substitute for installing the Excel fixes.
Affected systems and versions
NVD's CNA-supplied affected version ranges use the fixed builds as exclusive upper bounds:
- Microsoft Office LTSC 2021, Windows 32-bit and 64-bit: from
16.0.1up to, but not including,16.0.14334.21048 - Microsoft Office LTSC 2024, Windows 32-bit and 64-bit: builds before
16.0.17932.21140 - Microsoft Office 365 for Mac: builds before
16.115.26110837 - Microsoft Office LTSC for Mac 2021: builds before
16.115.26110837 - Microsoft Office LTSC for Mac 2024: builds before
16.115.26110837 - Office Online Server: builds before
16.0.10417.20236(installations without KB5002946) - Microsoft 365 Apps for Enterprise, Windows 32-bit and 64-bit: builds below the channel-specific fixed build published in Microsoft's Office security release information
The vulnerable configuration is any of these installations where a user opens an attacker-supplied workbook and creates a Forecast Sheet with modified forecast options. Previewing the file in the Preview Pane is not sufficient.
Vendor security history
The broader context for Microsoft is a mix of heavy enterprise dependence, a documented serious security failure, and an ongoing reform program.
- Exchange Online intrusion (2023): The Cyber Safety Review Board's March 20, 2024 report attributes the intrusion to Storm-0558, assessed as affiliated with the People's Republic of China. It affected 22 organizations and more than 500 individuals through Microsoft's authentication and signing key infrastructure. The Board concluded the intrusion was preventable, described a cascade of avoidable Microsoft security failures, found the company's security culture inadequate, and noted that a customer rather than Microsoft detected the activity. Nothing connects Storm-0558 to CVE-2026-118302.
- Secure Future Initiative: Launched in November 2023 and expanded in May 2024 to incorporate CSRB recommendations, built on secure by design, secure by default and secure operations. Microsoft's July 2026 progress report cites 99.97% phishing-resistant MFA coverage, 1.4 million unused Entra applications decommissioned, and more than 550,000 critical and high-risk open source vulnerability instances remediated. These are vendor-reported figures and do not validate this specific Excel patch.
- Recurring Excel fixes: KB5002946 supersedes the October Office Online Server update KB5002928 and bundles many other Excel remote code execution and information disclosure CVEs from the same release, which shows how often Excel parsing code receives security fixes.
- Scale: A provisional October 16, 2026 announcement from the UK Competition and Markets Authority states that Microsoft business software is used by over 1 million UK businesses and public-sector organizations with around 20 million monthly users. These figures describe the ecosystem, not the vulnerable install base.
For this vulnerability, the actionable evidence remains the advisory, its fixed builds and the supported deployment procedures.
References
- NVD: CVE-2026-118302
- CVE Record: CVE-2026-118302
- Microsoft Security Update Guide: CVE-2026-118302
- Security update for Office Online Server: November 10, 2026 (KB5002946)
- NVD API record for CVE-2026-118302
- Release notes for Microsoft Office security updates
- Apply software updates to Office Online Server
- How to update Microsoft 365 or Office for Windows
- Release notes for Office for Mac
- MITRE CWE-122: Heap Based Buffer Overflow
- CISA Stakeholder Specific Vulnerability Categorization Guide
- CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Expanding Microsoft's Secure Future Initiative
- SFI Progress Report July 2026
- CMA takes first steps to ensure choice in business software
- Senserva: CVE-2026-118302 Office Online Server fix KB5002946
- isMalicious: CVE-2026-118302
