Overview of CVE-2026-118703: Use After Free in Microsoft Office Excel Leading to Remote Code Execution

Introduction

Microsoft's November 10, 2026 Patch Tuesday fixed a use after free in Excel that can lead to code execution in the context of the logged-on user. The trigger is an ordinary sequence of actions in a crafted workbook. The fix spans Windows desktop Office, Office for Mac, and Office Online Server, so confirm installed builds rather than assuming coverage.

The issue has a CVSS 3.1 base score of 8.8 (High) and a temporal score of 7.7. Microsoft rates its maximum severity as Important. At publication Microsoft reported it as not publicly disclosed and not exploited.

Technical information

Root cause

The weakness is classified as CWE 416, use after free. MITRE defines this as software using or referencing memory after that memory has been freed. In this case, Excel keeps using a pointer to an object after the object's memory has been released.

Microsoft has not published the code-level change, and Excel is closed source, so there is no public commit or diff. MSRC does provide the user interaction sequence that reaches the bug:

1. The victim opens a specially crafted workbook.
2. The victim cuts and pastes an object inside that workbook.
3. The victim closes Excel.

That sequence points to an object lifetime problem. The cut-and-paste operation detaches and moves an object, and a stale reference to it is used again while the application shuts down. Fixes for this class of bug usually correct reference counting or ownership so that an object stays alive while anything still points to it, or clear stale pointers when the object is freed. This is an inference from the bug class. Microsoft has not confirmed it.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Reading the vector:

Attack flow

Based on Microsoft's description, exploitation looks like this:

1. An attacker prepares a workbook crafted to set up the vulnerable object state.
2. The attacker delivers it to a target over a network and persuades the user to open it.
3. The user cuts and pastes an object in the workbook.
4. The user closes Excel, at which point the freed object is referenced again.
5. If the exploit succeeds, attacker-controlled code runs with the user's privileges.

Two details matter for scoping. First, the code runs as the user, not as SYSTEM, so the impact tracks the privileges of whoever opens the file. Second, Microsoft states that the Preview Pane is not an attack vector. Previewing the file is not enough to trigger the bug, and disabling the Preview Pane is not a mitigation for this CVE.

Exploitation status at publication

Microsoft's advisory recorded:

• Publicly disclosed: No
• Exploited: No
• Exploitability assessment: Exploitation Less Likely
• Exploit code maturity: Unproven (no publicly available exploit code, or a theoretical exploit)

The advisory and CVE record do not name a threat actor, campaign, or victim. These are publication-time assessments and guarantee nothing about later activity.

Patch information

Microsoft fixed CVE-2026-118703 in its November 10, 2026 Patch Tuesday release. The MSRC advisory sets Remediation Level to Official Fix (RL:O), meaning a full vendor fix is available and no interim workaround is involved. The fix ships only as updated binaries, so build numbers are how you confirm it is installed.

Fixed builds by product

From the MSRC Security Updates table, which matches the CNA data on NVD:

Any build lower than the one listed is vulnerable. Microsoft 365 Apps has no single fixed number because each servicing channel (Current, Monthly Enterprise, Semi Annual) gets its own patched build. Check the channel-specific build against Microsoft's Office security release notes.

Office Online Server: KB5002946

Office Online Server is the only affected product with a standalone, versioned KB package:

• Package build: 16.0.10417.20236. The release version of Office Online Server must already be installed.
• Bundled fixes: KB5002946 is a cumulative Excel security rollup. It fixes CVE-2026-118703 along with many other Excel remote code execution and information disclosure CVEs from the same month, such as CVE-2026-118704 through CVE-2026-118732.
• Supersedence: It replaces the October 2026 update KB5002928, so earlier Excel fixes carry forward.
• Delivery: Microsoft Update (automatic when automatic updating is enabled), the Microsoft Update Catalog, or the Download Center (download ID 108899).
• Integrity check: If you stage the package manually, verify the full file installer hash:

wacserver2019-kb5002946-fullfile-x64-glb.exe
SHA256: F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0

Desktop clients

Windows desktop Office (Microsoft 365 Apps and the LTSC 2021 and 2024 editions) installs through Click to Run, so the fix arrives as a whole new Office build rather than a separate KB per file. Once a client updates to the patched build for its channel, it is protected. On macOS, Microsoft AutoUpdate delivers the fix in version 16.115.26110837. Rapid7's vulnerability database gives the same remediation: install KB5002946 for Office Online Server, or upgrade Office to the latest version.

No separate workaround is documented in the sources we reviewed.

Affected systems and versions

The CVE record lists the following affected ranges:

For Microsoft 365 Apps for Enterprise, the CVE record points to Office Security Releases rather than a single build, and the Microsoft 365 Apps security update page we reviewed does not name this CVE. Confirm the exact build for each channel directly with Microsoft's release notes.

Vendor security history

Microsoft Corporation is the assigning CNA for this CVE, and MSRC hosts the advisory. The most concrete context in our sources is Excel's patch cadence. KB5002946 bundles fixes for a large set of Excel remote code execution and information disclosure CVEs from November 2026 alone, and it supersedes the October 2026 Excel rollup KB5002928. MSRC describes its mission as protecting customers, communities, and Microsoft, and says it works with security researchers to identify and fix vulnerabilities. That is a company description, not an independent comparative assessment.

References

• NVD entry for CVE-2026-118703
• CVE.org record for CVE-2026-118703
• Microsoft Security Update Guide: CVE-2026-118703 Excel Remote Code Execution Vulnerability
• Microsoft Support: Security update for Office Online Server, November 10, 2026 (KB5002946)
• Rapid7 vulnerability database entry for CVE-2026-118703
• Microsoft Learn: Release notes for Microsoft Office security updates
• Microsoft Learn: Update history for Office LTSC 2024 and Office 2024
• Tenable plugin: Security Updates for Microsoft Office Products (November 2026)
• Senserva: KB5002946 Office Online Server Security Update (November 2026)
• MITRE CWE 416: Use After Free
• MSRC: What to expect when reporting vulnerabilities to Microsoft
• Microsoft 2026 Annual Report
• Microsoft Digital Defense Report