Introduction
Microsoft's November 10, 2026 Patch Tuesday release fixed a stack-based buffer overflow in Excel that can lead to remote code execution when a user opens a crafted file. The affected list spans Microsoft 365 Apps, perpetual Office LTSC editions on Windows and Mac, and Office Online Server, so this single CVE touches several distinct patching workflows inside the same organization.
CVE-2026-118700 carries a CVSS v3.1 base score of 8.8 (High), and Microsoft rates its product severity as Important. At publication, Microsoft listed it as neither publicly disclosed nor exploited and assessed exploitation as less likely. This post summarizes what the official sources establish, what they leave open, and how the fix maps to specific builds.
Technical Information
Root cause
Microsoft classifies the weakness as CWE-121, Stack-Based Buffer Overflow. MITRE defines this category as writing past the end of a buffer allocated on the stack, with general consequences that include crashes, memory modification, and arbitrary code execution.
In practice, a parser copies data from a file into a fixed-size buffer on the call stack without checking that the data fits. The excess bytes overwrite adjacent stack data, such as saved return addresses, which can give an attacker control over execution flow. Fixes for this class of bug typically add length or bounds validation before the copy, or switch to bounded copy routines.
Excel is closed source, Microsoft has not published a diff, and the advisory does not disclose:
- the vulnerable parsing routine or function
- the malformed file structure that triggers the overflow
- the stack layout or exploitation technique
- any working exploit procedure
The one structural hint is that Microsoft explicitly states the Preview Pane is not an attack vector. That points to code that runs during full workbook parsing in Excel, rather than in the lighter rendering path used for previews.
Scoring breakdown
The published base vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack Vector: Network. Microsoft classifies the attack as network accessible, while separately requiring the crafted file to be opened.
- Attack Complexity: Low. No specialized access conditions or extenuating circumstances are required.
- Privileges Required: None. The attacker needs no prior authorization.
- User Interaction: Required. A user must act before exploitation succeeds.
- Scope: Unchanged. Impact stays within the same security authority.
- Confidentiality, Integrity, Availability: High for each.
Attacker privileges and victim interaction are separate measures here. The attacker needs no access, but a user must open the file. Simply receiving or previewing the file does not trigger the bug, which sets it apart from an interaction-free network service exploit.
The temporal score is 7.7, lower than the 8.8 base score because exploit code maturity is Unproven (E:U) and an Official Fix exists (RL:O). These are different CVSS measurements rather than conflicting severity assessments.
Attack flow
Based solely on Microsoft's documentation, the sequence is:
- The attacker prepares a specially crafted file containing data that overflows a stack buffer during Excel's parsing. The specific structure is undisclosed.
- The attacker gets the file to a target user. The advisory does not describe a specific delivery channel.
- The user opens the file in Excel. Viewing it in the Preview Pane is not sufficient.
- Excel parses the file, the stack buffer overflows, and the attacker achieves code execution.
The advisory does not state the privilege level of the resulting code execution, does not mention a macro requirement, and does not describe additional exploitation steps. The available material does not support claims of administrator or SYSTEM-level execution, specific payloads, or a full exploit chain.
Exploitation status
- Microsoft advisory at publication: Publicly disclosed: No; Exploited: No; Exploitation Less Likely.
- Exploit code maturity: Unproven, meaning no public exploit code exists or the exploit is theoretical.
- CISA Coordinator SSVC data in NVD (November 10): exploitation: none; automatable: no; technical impact: total.
No threat actor, campaign, malicious file hash, or command and control infrastructure is associated with this CVE in the reviewed sources. We could not establish a definitive CISA KEV catalog status from the retrieved view, so we make no claim either way. Microsoft credits Jeongmin Choi (@lmksecurity) with reporting the issue.
Patch Information
Microsoft fixed CVE-2026-118700 on November 10, 2026. MSRC rates the remediation level Official Fix, so the update itself is the complete solution and no interim workaround is involved. Since no source diff exists, defenders should treat the patch as a set of version boundaries: any build at or above the listed number contains the fix.
Fixed builds by product
- Microsoft 365 Apps for Enterprise (32-bit and x64): channel dependent; see Office Security Releases. Delivered as a Click to Run channel update and documented in the Microsoft 365 Apps security release notes.
- Microsoft Office LTSC 2024 (32-bit and x64): 16.0.17932.21140, Click to Run security update.
- Microsoft Office LTSC 2021 (32-bit and x64): 16.0.14334.21048, Click to Run security update.
- Microsoft Office 365 for Mac: 16.115.26110837, Office for Mac release via Microsoft AutoUpdate.
- Microsoft Office LTSC for Mac 2024 and 2021: 16.115.26110837, Office for Mac release.
- Office Online Server: 16.0.10417.20236, via KB5002946.
Click to Run and Mac clients
Microsoft 365 Apps, Office LTSC 2021 and 2024, and the Mac editions have no per-CVE KB. They receive the fix through their normal servicing channel and are protected once the client reports the fixed build or later. For Microsoft 365 Apps, the fixed build depends on the update channel (Current, Monthly Enterprise, or Semi Annual), which is why MSRC points to the Office security release notes rather than giving a single number.
Office Online Server: KB5002946
Office Online Server is the only affected product with a traditional standalone KB package, and it needs the most attention from on-premises administrators.
- Bundled fixes: besides CVE-2026-118700, KB5002946 fixes dozens of other Excel vulnerabilities from the same release, including CVE-2026-118701 and CVE-2026-118703 through CVE-2026-118732, plus several CVE-2026-1182xx and CVE-2026-1247xx/1241xx entries.
- Build: installs 16.0.10417.20236.
- Prerequisite: the release version of Office Online Server must already be installed.
- Supersedence: replaces KB5002928. That update does not need to be installed first.
- Sources: Microsoft Update, the Microsoft Update Catalog (search
KB5002946), or the Microsoft Download Center (download ID 108899).
Microsoft publishes a SHA256 hash for the installer. Verify it before offline deployment:
wacserver2019-kb5002946-fullfile-x64-glb.exe SHA256: F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0
Microsoft also links a CSV listing every file the update replaces, which is useful for confirming which binaries changed after installation.
Office Online Server farm procedure
The KB article and Microsoft's Office Online Server guidance disagree on delivery. The KB article lists automatic delivery through Microsoft Update, but the dedicated Office Online Server guidance states that applying updates through the automatic updates process is unsupported. That guidance warns an incorrectly updated installation can stop users from viewing or editing documents and may require rebuilding the farm.
The supported procedure preserves the existing farm configuration and recreates the farm as part of the update:
- Single-server farm: remove the server from the farm, install the update, restart if prompted, and recreate the farm with the original parameters. Office Online is unavailable during this window.
- Multiple-server farm: remove and update servers in sequence, create an updated farm, join the remaining updated servers to it, and switch load-balanced traffic once capacity is sufficient. This is Microsoft's documented path for maintaining document access during the update.
Having the correct package is necessary, but it does not by itself confirm that the server deployment was performed correctly.
Affected Systems and Versions
On NVD, the CNA's affected version ranges end just below each fixed build, so the listed build is the first fixed version. Windows entries cover both 32-bit and x64 editions.
- Office Online Server: 16.0.0.0 up to, but not including, 16.0.10417.20236
- Microsoft Office LTSC 2024: builds below 16.0.17932.21140
- Microsoft Office LTSC 2021: builds below 16.0.14334.21048
- Microsoft Office 365 for Mac: builds below 16.115.26110837
- Microsoft Office LTSC for Mac 2024: builds below 16.115.26110837
- Microsoft Office LTSC for Mac 2021: builds below 16.115.26110837
- Microsoft 365 Apps for Enterprise: builds below the channel-specific fixed release listed in the Office security release notes
KB5002946 applies only to Office Online Server. It is not the update package for the desktop or Mac editions.
Vendor Security History
The most cited independent assessment of Microsoft's security posture is the Cyber Safety Review Board's review of the summer 2023 Exchange Online intrusion, in which Storm 0558 obtained a Microsoft signing key and used it to access enterprise Exchange accounts. The Board concluded that Microsoft's security culture was inadequate, identified a cascade of avoidable errors including paused manual key rotation and incomplete migration to automatic rotation, and called for direct CEO and board oversight.
Microsoft's April 21, 2025 Secure Future Initiative progress report gives the vendor's account of its response. It describes additional detections, proactively discovered vulnerabilities, and progress against security objectives, while acknowledging that further work remains. These are vendor-reported improvements, not independent certification.
Neither document relates to the cause or exploitation of this Excel vulnerability, and Storm 0558 is not associated with CVE-2026-118700. The practical takeaway is to evaluate concrete fixes and deployment outcomes rather than relying on vendor scale or reform commitments.
References
- NVD entry for CVE-2026-118700
- CVE Record for CVE-2026-118700
- MSRC Security Update Guide: Microsoft Office Excel Remote Code Execution Vulnerability
- Microsoft Support: KB5002946
- Security update for Office Online Server: November 10, 2026 (KB5002946)
- NVD API record
- Release notes for Microsoft Office security updates
- Release notes for Office for Mac
- Apply software updates to Office Online Server
- CWE-121: Stack-Based Buffer Overflow
- VulDB entry
- Senserva: Office Online Server fix KB5002946
- CISA Known Exploited Vulnerabilities Catalog
- CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft Secure Future Initiative: April 2025 progress report
- Microsoft 2026 Annual Report
- Microsoft 365 Enterprise licensing
