Brief Summary: CVE-2026-118702, a Double Free Remote Code Execution Flaw in Microsoft Excel

Introduction

If a user opens a crafted spreadsheet in an unpatched copy of Microsoft Excel, a remote attacker can run code on that machine. The CVSS 3.1 vector rates the confidentiality, integrity, and availability impact as High. Microsoft fixed the issue in its November 10, 2026 Patch Tuesday release, with updated builds for both Windows and Mac Office product families.

The NVD record lists the vendor as unknown, but Microsoft's advisory identifies the affected product as Microsoft Office Excel. Severity appears under two labels:

CVSS 3.1 base score: 8.8 (High), supplied by the Microsoft CNA.
Microsoft product severity: Critical.

These are two different rating schemes, so both are worth keeping when you communicate risk internally.

Microsoft's exploitation assessment for this CVE:

Publicly disclosed: No
Exploited: No
Exploitability: Exploitation Less Likely
Exploit code maturity: Unproven

Microsoft credits Haein Lee with KAIST Hacking Lab for the report.

Technical Information

Root cause: a double free in workbook parsing

The assigned weakness is CWE 415, Double Free. MITRE defines it as calling free() twice on the same memory address. According to the patch information, Excel can release the same block of heap memory twice while parsing a malicious workbook.

MITRE lists the general consequences of this weakness class:

corruption of memory management structures
crashes
unexpected memory access
under some circumstances, arbitrary code execution

Those consequences describe the bug class, not confirmed behavior in Excel. Excel is closed source, so there is no public diff or commit to inspect. Microsoft has not disclosed:

the vulnerable function
the record or structure type that triggers the bug
the allocator behavior involved
the code path it changed

The advisory also leaves out several details that defenders often ask about:

a required file extension
whether macros must be enabled
whether external link updates are involved
a payload
the privilege level of the resulting code execution

We treat all of these as undisclosed rather than guessing.

Reading the CVSS vector correctly

The published base vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AV:N, AC:L: the malicious file can be delivered remotely, and the attack has low complexity.
PR:N: the attacker needs no prior authorization on the target.
UI:R: a user must take an action. Microsoft specifies that action as opening the file.
S:U: the impact stays within the same security authority.
C:H, I:H, A:H: the impact on confidentiality, integrity, and availability is High.

The network classification describes how the file can arrive, not how it runs. It does not mean Excel exposes a listening service, or that simply receiving a file triggers the bug. Microsoft's FAQ states: "This attack requires a user to open a specially crafted file from the attacker to initiate remote code execution." It also states that the Preview Pane is not an attack vector.

Attack flow

This flow is based only on the published details:

The attacker builds a workbook that drives Excel's parsing logic into freeing the same heap allocation twice. Which structures are involved has not been disclosed.
The attacker gets the file to the target over a network channel, with no privileges on the target system. The advisory does not name a specific delivery method.
The victim opens the file in Excel. Rendering it in the Preview Pane is not enough, according to Microsoft.
While Excel parses the workbook, the same heap block is released twice, which corrupts heap state.
If the attacker can shape that corrupted state, the result can be code execution with High impact to confidentiality, integrity, and availability. The advisory does not describe the privilege level of the resulting code.

Patch Information

Microsoft fixed CVE-2026-118702 on November 10, 2026, in its regular monthly security release. The advisory sets the CVSS temporal Remediation Level to Official Fix (RL:O), defined as "A complete vendor solution is available." This lowers the temporal score from 8.8 to 7.7.

Microsoft does not say which code path it changed. Fixes for double frees typically free each object in exactly one place and then clear or reset the pointer, so that a later error path or cleanup routine cannot free it again. That describes the bug class. Microsoft has not confirmed it for this patch. The practical way to verify a fix is to check the build number.

Fixed builds from the MSRC Security Update Guide

Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140
Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048
Microsoft Office LTSC for Mac 2021: 16.115.26110837
Microsoft Office LTSC for Mac 2024: 16.115.26110837
Microsoft Office 365 for Mac: 16.115.26110837
Microsoft 365 Apps for Enterprise (32 bit and 64 bit): varies by channel; see the Office security release notes

Microsoft 365 Apps builds by channel

Microsoft 365 Apps is updated through servicing channels, so the advisory does not give a single build. The November 10, 2026 Office security release notes list CVE-2026-118702 under the Excel section. The builds released that day are:

Current Channel: Version 2610 (Build 20527.20196)
Monthly Enterprise Channel:
- Version 2610 (Build 20527.20194)
- Version 2609 (Build 20430.20264)
- Version 2608 (Build 20326.20320)
Semi Annual Enterprise Channel:
- Version 2610 (Build 20527.20192)
- Version 2609 (Build 20430.20262)
- Version 2608 (Build 20326.20318)
Office 2024 and Office 2021 Retail: Version 2610 (Build 20527.20196)
Office LTSC 2024 Volume Licensed: Version 2408 (Build 17932.21140)
Office LTSC 2021 Volume Licensed: Version 2108 (Build 14334.21048)

The LTSC volume licensed builds match the fixed builds in the MSRC list above, which confirms that the November update is the one that fixes this CVE.

How the fix reaches machines

Click to Run installs (Microsoft 365 Apps, Retail, LTSC) receive the fixed build through Office's normal automatic updates, or through whatever update management your organization uses.
Windows, manual update: open a Microsoft 365 application and select File > Account > Update Options > Update Now. Select Enable Updates first if needed. If Update Options is missing, volume licensing or Group Policy may be controlling updates.
Managed Windows environments: updates are configured through the Office Deployment Tool or Group Policy. Group Policy can prevent users from changing the configured update setting.
Mac, installed from Microsoft: version 16.115.26110837 arrives through Microsoft AutoUpdate. You can also select Help > Check for Updates in any Microsoft 365 application.
Mac, installed from the Mac App Store: use Updates, then Update All or the individual application's Update control.

There is one timing caveat for Mac. When retrieved for this review, the general Office for Mac update history page showed November 4 as its latest release, while the CVE advisory lists the November 10 build. Do not read the history page as evidence that the fix is unavailable.

Microsoft released no separate out-of-band hotfix and no configuration-based workaround. Installing the updated build is the fix. The advisory is at version 1.0, published November 10, 2026, and fixed builds shipped the same day the vulnerability was disclosed.

Affected Systems and Versions

NVD's CNA-supplied affected version data uses the same boundaries as the MSRC fixed builds. Any build at or above the fixed build includes the fix.

Microsoft Office LTSC 2024, 32 bit and 64 bit: builds earlier than 16.0.17932.21140
Microsoft Office LTSC 2021, 32 bit and 64 bit: builds earlier than 16.0.14334.21048
Microsoft Office LTSC for Mac 2021: builds earlier than 16.115.26110837
Microsoft Office LTSC for Mac 2024: builds earlier than 16.115.26110837
Microsoft Office 365 for Mac: builds earlier than 16.115.26110837
Microsoft 365 Apps for Enterprise, 32 bit and 64 bit: builds older than the November 10, 2026 release for the machine's servicing channel, as listed in the Patch Information section

The only exploitation scenario Microsoft documents is a user opening an attacker-supplied file in Excel. The Preview Pane is not an attack vector.

Vendor Security History

The Cyber Safety Review Board reviewed the 2023 Exchange Online intrusion and reached these conclusions:

The intrusion was preventable.
Microsoft's security culture was inadequate and needed an overhaul.
There were avoidable errors, failures involving cryptographic security, inadequate controls, and problems correcting inaccurate public statements.

The Board recommended direct leadership oversight and a time-bound reform plan.

Microsoft's response is the Secure Future Initiative (SFI). Its July 2026 progress report describes:

broader enforcement of source code access controls
centrally governed build pipeline templates
a shift toward governed prevention in software supply chain security

These are Microsoft's own reported changes, not an independent evaluation, and none of the reviewed sources ties them to this Excel fix. The Exchange Online case is a separate incident, and none of the reviewed sources links it to this double free. For the remediation decision, the advisory and the build data above are what matter.

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical Information