Brief Summary: CVE-2026-118701, Microsoft Excel Heap Buffer Overflow Enabling Remote Code Execution

Introduction

A heap buffer overflow in Microsoft Office Excel lets an attacker run code with the privileges of any user who can be persuaded to open, and then save, a specially crafted workbook. Microsoft fixed the flaw in its November 10, 2026 Patch Tuesday release. The affected products include Microsoft 365 Apps, Office LTSC for Windows and Mac, Office for Mac, and Office Online Server, so remediation has to be handled product by product rather than as a single desktop update.

Microsoft scores CVE-2026-118701 at CVSS 3.1 8.8 (High) and lists its maximum severity as Critical. At release, its advisory reported the issue as not publicly disclosed, not exploited, and "Exploitation Less Likely." This post summarizes what the published sources establish and what they leave unanswered.

Technical information

Root cause

Microsoft classifies the defect as CWE-122, heap-based buffer overflow. Excel writes past the end of a heap allocation while processing a specially crafted workbook that the user opens and then saves. MITRE defines CWE-122 as writing past the end of a buffer allocated on the heap. Its general consequences include crashes, memory modification, and potentially arbitrary code execution, for example through overwritten function pointers.

The weakness class explains the outcome but not the specifics. Excel is closed source, there is no public commit or diff, and Microsoft's advisory does not disclose:

• the vulnerable function or parser component
• the malformed workbook structure
• a particular file extension
• any macro requirement
• the corrupted heap object or the exploitation technique

This post includes no code snippets because none exist in the public record. Microsoft has also not described how it changed the code. Fixes for this bug class usually validate the size of attacker-controlled data before copying it into a heap buffer, or size the allocation from the actual data length. That is a general pattern and has not been confirmed for this CVE.

Attack flow

Microsoft's exploitation FAQ describes the following sequence:

1. The attacker builds a specially crafted workbook that triggers the overflow.
2. The attacker convinces a user to open the workbook in an affected version of Excel. The advisory does not name a specific delivery channel.
3. The user opens the workbook. Microsoft states that the Preview Pane is not an attack vector, so previewing the file does not carry the same exposure.
4. The user saves the workbook. The advisory does not say the file must be saved as a web page or in any particular format. It documents only the open and save workflow.
5. If exploitation succeeds, attacker code runs with the privileges of that user. The advisory documents user-level execution and makes no claim of administrator access.

For awareness messaging and risk scoring, the requirement that matters is that a user has to open the file and then save it. Receiving the file does not execute anything, and neither does previewing it.

Reading the CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• AV:N, AC:L: Network attack vector and low complexity. The score assumes neither local attacker access nor a high-complexity condition.
• PR:N: The attacker needs no prior privileges.
• UI:R: User interaction is required. This is the open and save workflow described above.
• S:U: Scope is unchanged. The score does not claim a change of security authority.
• C:H, I:H, A:H: High impact to confidentiality, integrity, and availability.
• E:U: Exploit code maturity is Unproven, meaning no exploit code is publicly available or the exploit is theoretical.
• RL:O: Official Fix, which Microsoft defines as a complete vendor solution.
• RC:C: Report confidence is Confirmed.

The temporal metrics lower the score from 8.8 to 7.7. That lower number reflects exploit maturity and fix availability. It does not mean unpatched installations are safe. The Network metric and the required user interaction are compatible. Neither the vector nor the description implies an Excel network service that can be attacked without a user.

NVD lists the record as Undergoing Enrichment. The 8.8 score shown there comes from Microsoft as the CNA, and NIST has not yet published its own assessment.

Exploitation status

• Microsoft's advisory reports Publicly disclosed: No, Exploited: No, and Exploitation Less Likely.
• VulDB lists KEV status as "no" and shows no public exploit or named threat actor.
• Senserva reports that the vulnerability is not in CISA's Known Exploited Vulnerabilities catalog.
• The reviewed material names no attacker, campaign, victim, malware family, or CVE-specific indicator of compromise.

"Publicly disclosed: No" refers to whether details were public before release. It is a separate matter from the CVE record itself, which was published on November 10, 2026. Likewise, a negative KEV status describes observed exploitation to date. It does not prove that undisclosed attacks cannot exist, and it should not outweigh the documented impact or the availability of a fix.

Patch information

Microsoft fixed CVE-2026-118701 in its November 10, 2026 Patch Tuesday release, and the MSRC advisory marks the Remediation Level as Official Fix. The vulnerable code ships inside the Excel binaries, so the only way to get the fix is to install an updated Office build. No configuration change or registry setting closes it, and the advisory describes no CVE-specific workaround.

Fixed builds

These builds come from the MSRC Security Updates table and match NVD's affected version ranges. Any build lower than the one listed is vulnerable.

• Microsoft 365 Apps for Enterprise (32 bit and x64): The fixed build depends on the update channel. See Microsoft Office security release notes. The fix is delivered as a Click to Run update in the November 2026 channel builds.
• Office LTSC 2024 (32 bit and x64): 16.0.17932.21140, delivered as a Click to Run security update.
• Office LTSC 2021 (32 bit and x64): 16.0.14334.21048, delivered as a Click to Run security update.
• Office 365 for Mac, Office LTSC for Mac 2021 and 2024: 16.115.26110837, delivered through Microsoft AutoUpdate and documented in the Mac release notes.
• Office Online Server: 16.0.10417.20236, delivered as KB5002946.

Microsoft 365 Apps has no single fixed build. Each update channel (Current, Monthly Enterprise, Semi Annual Enterprise, and others) receives its own November 2026 build number. Look up your channel in the Microsoft 365 Apps security update release notes and confirm that the installed build is equal to or higher than the one listed there. NVD records this boundary as:

16.0.1 < https://aka.ms/OfficeSecurityReleases

Office Online Server: KB5002946

Server teams should note the following about this package:

• It is a cumulative Excel security rollup, not a single CVE fix. It covers CVE-2026-118701 along with dozens of other November Excel CVEs, including CVE-2026-118700 and CVE-2026-118703 through CVE-2026-118732. One install fixes the whole group.
• It replaces the earlier update KB5002928.
• It requires the release version of Office Online Server to already be installed.
• It is available from Microsoft Update, the Microsoft Update Catalog, and the Microsoft Download Center (download ID 108899). If automatic updating is enabled, the update downloads and installs automatically.
• For deployment details, the KB points administrators to the Security Update Guide deployments page.

If you deploy the package by hand, check the installer hash first:

File:   wacserver2019-kb5002946-fullfile-x64-glb.exe
SHA256: F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0

Installation routes

On Windows installations that show the standard update controls, Microsoft documents this path: open a Microsoft 365 application, create a document, and choose File > Account > Update Options > Update Now. If that option is unavailable, select Enable Updates first. If Update Options is missing and only About appears, the installation may use volume licensing or company Group Policy. In that case, Microsoft's guidance is to use Microsoft Update or contact the company help desk.

On Office for Mac, Help > Check for Updates launches Microsoft AutoUpdate. Administrators can also download and deploy application update packages directly.

Confirming the patch

Clients do not need a separate KB check. Compare the installed Office build against the list above.

• Windows: File > Account > About Excel
• Mac: Excel > About Excel
• Office Online Server: confirm that KB5002946 is installed or that the reported build is 16.0.10417.20236

If the build meets or exceeds the fixed version for that product and channel, the overflow is fixed.

A note on unrelated version numbers

A snippet from the Action1 November 2026 roundup lists versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9. Those numbers belong to a different product in the same roundup and have nothing to do with this Excel fix.

Affected systems and versions

In Microsoft's CVE record, the "affected from" version is inclusive and the fixed boundary is excluded from the affected range.

• Microsoft 365 Apps for Enterprise, 32 bit and x64: from 16.0.1, with the fixed boundary published per channel at OfficeSecurityReleases
• Microsoft Office 365 for Mac: from 1.0.0 up to, but not including, 16.115.26110837
• Microsoft Office LTSC 2021, 32 bit and x64: from 16.0.1 up to, but not including, 16.0.14334.21048
• Microsoft Office LTSC 2024, 32 bit and x64: from 16.0.0 up to, but not including, 16.0.17932.21140
• Microsoft Office LTSC for Mac 2021: from 16.0.1 up to, but not including, 16.115.26110837
• Microsoft Office LTSC for Mac 2024: from 16.0.0 up to, but not including, 16.115.26110837
• Office Online Server: from 16.0.0.0 up to, but not including, 16.0.10417.20236 (KB5002946)

The affected range reaches beyond Windows desktop installs. A fixed Mac build does not stand in for a Windows LTSC build, and Office Online Server needs its own server-side update.

Vendor security history

Microsoft is both the affected vendor and the CNA for this record. The Cyber Safety Review Board describes Microsoft as sitting "at the center of the technology ecosystem" and calls its products "ubiquitous and critical" to essential services supporting national security, the economy, and public health and safety.

The Board's review of the Summer 2023 Exchange Online intrusion attributes it to Storm-0558, a group associated with the government of the People's Republic of China. The intrusion reached official email accounts of senior United States government officials. The Board identified a cascade of avoidable Microsoft security errors, concluded that the intrusion was preventable, and said Microsoft's security culture required an overhaul. It recommended leadership accountability and a public reform plan. That case involved identity and signing key failures, not Excel workbook processing, and it provides no attribution or exploitation evidence for CVE-2026-118701.

Microsoft's July 2026 Secure Future Initiative progress report organizes its work around secure foundations, proactive defense, and future-ready security. The report says Microsoft has kept code review and penetration testing and added AI-assisted vulnerability discovery. These are program changes reported by Microsoft itself, not an independent certification of their effectiveness, and neither source suggests that program-wide improvements eliminate memory safety defects in applications. For this vulnerability, the direct remediation evidence is the CVE record and the published security updates.

References

• Microsoft Security Update Guide: CVE-2026-118701
• NVD: CVE-2026-118701
• CVE Record: CVE-2026-118701
• Security update for Office Online Server: November 10, 2026 (KB5002946)
• Download Center: Security Update for Office Online Server (KB5002946)
• Action1: Patch Tuesday November 2026
• Release notes for Microsoft Office security updates
• Release notes for Office for Mac
• How to update Microsoft 365 or Office for Windows
• MITRE CWE-122: Heap Based Buffer Overflow
• Qualys: Microsoft Patch Tuesday, November 2026 Security Update Review
• Cisco Talos: Microsoft Patch Tuesday for November 2026
• Senserva: CVE-2026-118701
• VulDB: CVE-2026-118701
• CISA Known Exploited Vulnerabilities Catalog
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft Secure Future Initiative: July 2026 progress report
• Announcing the retirement for Office Online Server