Introduction
Microsoft's November 10, 2026 security release closed a stack-based buffer overflow in Excel. Once a user interacts with a crafted embedded chart, the bug could give an attacker code execution in that user's security context. The affected product list runs from Microsoft 365 Apps and Office LTSC on Windows to Office for Mac and Office Online Server, so remediating CVE-2026-118704 means following several distinct update paths, not installing one package.
NVD scores the issue CVSS 3.1 8.8 (High), and Microsoft gives it an Important severity rating. The two come from separate classification systems, so they do not conflict. At publication, Microsoft reported no exploitation and no prior public disclosure.
Technical information
Root cause
Microsoft classifies the weakness as CWE-121: Stack based Buffer Overflow. MITRE defines this as writing beyond the end of a buffer allocated on the stack, with general consequences that can include crashes and arbitrary code execution.
In this bug class, data taken from a file is copied into a fixed-size buffer on the stack without proper bounds checking. A long enough value overwrites nearby stack data, including saved return addresses, which can let an attacker take over execution.
Microsoft has not released code-level details. The advisory does not identify a specific document extension, chart subtype, malformed field, vulnerable function, or memory corruption primitive, and no vulnerable code has been published. Excel is closed source, so there is no public diff or commit to examine. The trigger sequence (below) points toward Excel's chart object handling, but that is an inference from the advisory. Microsoft has not confirmed the root cause.
Attack flow
Microsoft's FAQ describes the following exploitation sequence:
- An attacker prepares a specially crafted Office document containing an embedded chart.
- The attacker convinces a user to open that document.
- The user activates the embedded chart.
- The user selects an element in that chart.
- If exploitation succeeds, attacker-controlled code could execute with the privileges of that user.
The advisory states that the Preview Pane is not an attack vector. Receiving or previewing the document is not the documented trigger. The chart interaction is.
The impact is code execution in the user's context. The advisory does not establish an independent elevation to administrator privileges.
What the CVSS vector tells us
Microsoft publishes the following base vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack Vector: Network.
- Attack Complexity: Low.
- Privileges Required: None.
- User Interaction: Required. A separate user must participate, which is why the Network vector does not imply a service that can be compromised without user action.
- Scope: Unchanged.
- Confidentiality, Integrity, Availability: High for each.
Microsoft also publishes a temporal score of 7.7 alongside the 8.8 base score, reflecting exploit code maturity Unproven and remediation level Official Fix. The temporal score does not replace the base score.
Exploitation status at publication
Microsoft's exploitability assessment at original publication recorded:
- Publicly disclosed: No
- Exploited: No
- Assessment: Exploitation Less Likely
- Exploit code maturity: Unproven (public exploit code is unavailable or an exploit is theoretical)
The reviewed advisory and CVE record name no threat actor, campaign, victim organization, malware family, or public exploit implementation. The Qualys and Cisco Talos November 2026 Patch Tuesday reviews we looked at do not explicitly identify CVE-2026-118704. These assessments reflect the situation at publication and guarantee nothing about later activity. On the available evidence, though, this is not an actively exploited zero day.
Patch information
Microsoft fixed CVE-2026-118704 in its November 10, 2026 Patch Tuesday release, and the MSRC advisory marks the remediation level as Official Fix. MSRC lists the same build numbers that NVD uses as the exclusive upper bound of the affected range, so any build at or above these numbers is fixed.
Fixed builds by product
- Microsoft 365 Apps for Enterprise (32 bit and 64 bit): fixed build varies by channel (see Microsoft Office security release notes). Delivered as a Click to Run channel update.
- Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140, delivered as a Click to Run security update.
- Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048, delivered as a Click to Run security update.
- Microsoft Office 365 for Mac, Office LTSC for Mac 2021, Office LTSC for Mac 2024: 16.115.26110837, delivered as an Office for Mac release through Microsoft AutoUpdate.
- Office Online Server: 16.0.10417.20236, delivered as KB5002946.
Microsoft 365 Apps do not have a single fixed build. Each servicing channel (Current, Monthly Enterprise, Semi Annual) receives its own patched build, so check yours against the channel-specific table Microsoft links from the advisory.
On the Mac side, Microsoft AutoUpdate is reachable through Help > Check for Updates, and administrators can also push packages through existing software deployment tools. The fixed Mac version for this CVE comes from the MSRC advisory. We did not find an explicit CVE entry for it in the reviewed Mac release notes.
The Office Online Server package (KB5002946)
Office Online Server is the only affected product that gets a traditional KB-numbered package, which makes it the easiest delivery to audit:
- The KB article lists CVE-2026-118704 among the Excel bugs it fixes, alongside sibling Excel remote code execution and information disclosure CVEs from the same month, such as CVE-2026-118703, CVE-2026-118705 and CVE-2026-118707.
- The package is build 16.0.10417.20236 and requires the release version of Office Online Server to already be installed.
- It replaces KB5002928 from October 2026. Office Online Server updates are cumulative, so installing KB5002946 also brings in earlier Excel fixes, and environments that skipped earlier monthly updates can install it directly.
- It is available automatically through Microsoft Update, from the Microsoft Update Catalog, or from the Microsoft Download Center (download ID 108899).
If you download the package manually, verify the installer against the SHA256 hash Microsoft publishes before deployment:
wacserver2019-kb5002946-fullfile-x64-glb.exe F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0
The KB page also links a CSV from Microsoft listing every file the update changes, which you can use to confirm that patched binaries are in place on servers. KB5002946 applies only to Office Online Server. Windows Office and Office for Mac installations have their own update entries.
What the fix probably changes
Fixes for CWE-121 bugs usually do one or more of the following:
- check the length of file-supplied data against the destination buffer before copying it
- switch to bounded copy routines
- move variable-size data into a buffer sized from the validated input
Given the embedded chart trigger, the fixed code is likely in Excel's chart object handling. Microsoft has not confirmed this.
Confirming the fix is in place
No registry key or feature flag turns this protection on, and the advisory offers no workaround or configuration-based mitigation. The patched binary is the fix. You are protected only once Excel or Office Online Server reports a build at or above the version listed for your product and channel.
Affected systems and versions
NVD documents the following affected ranges, and Microsoft's advisory supplies the platform and update mappings:
- Microsoft 365 Apps for Enterprise, 32 bit and 64 bit: from 16.0.1, with the upper boundary defined by the Office security release notes for each servicing channel
- Microsoft Office LTSC 2021, 32 bit and 64 bit: from 16.0.1, before 16.0.14334.21048
- Microsoft Office LTSC 2024, 32 bit and 64 bit: from 16.0.0, before 16.0.17932.21140
- Microsoft Office 365 for Mac: from 1.0.0, before 16.115.26110837
- Microsoft Office LTSC for Mac 2021: from 16.0.1, before 16.115.26110837
- Microsoft Office LTSC for Mac 2024: from 16.0.0, before 16.115.26110837
- Office Online Server: from 16.0.0.0, before 16.0.10417.20236
The vulnerable condition is reached through a crafted document with an embedded chart that the user activates and interacts with. The advisory describes no additional vulnerable configuration.
Vendor security history
The Cyber Safety Review Board's review of the Summer 2023 Microsoft Exchange Online intrusion remains the most prominent independent assessment of Microsoft's security practices. It attributes the intrusion to Storm 0558, an actor associated with the government of the People's Republic of China, which accessed official email accounts of senior United States government officials. The Board concluded the intrusion should never have happened, identified a cascade of security failures, and described a culture that deprioritized enterprise security investment and rigorous risk management. It recommended direct CEO and Board attention, an accountable reform plan, and making security a design requirement.
Microsoft's July 2026 Secure Future Initiative progress report describes its corrective work, including completed deployment of phishing-resistant, credential-safe defaults, broad enforcement of Zero Trust for source code access, and decommissioning of 1.4 million unused Entra applications. These are Microsoft's own reported results.
Neither document relates to CVE-2026-118704 directly. In particular, Storm 0558 should not be carried over as an attribution for this Excel vulnerability, for which Microsoft reports no exploitation at publication.
References
- NVD: CVE-2026-118704
- CVE Record: CVE-2026-118704
- Microsoft Security Update Guide: CVE-2026-118704, Microsoft Office Excel Remote Code Execution Vulnerability
- Description of the security update for Office Online Server: November 10, 2026 (KB5002946)
- Release notes for Microsoft Office security updates
- Office Security Releases (channel specific builds)
- Release notes for Office for Mac
- CWE-121: Stack based Buffer Overflow
- Qualys: Microsoft Patch Tuesday, November 2026 Security Update Review
- Cisco Talos: Microsoft Patch Tuesday for November 2026
- Senserva: CVE-2026-118704, Office Online Server fix KB5002946
- CSRB: Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft Trust Center: SFI Progress Report July 2026
- Microsoft 2026 Annual Report
