Brief Summary: Microsoft Excel CVE-2026-118706 Use After Free Remote Code Execution

Introduction

A use after free in Microsoft Excel, fixed in Microsoft's November 10, 2026 security release, can let an attacker execute code with the privileges of a user who converts a specially crafted workbook to another file format. The affected range covers Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows and Mac, Office 365 for Mac, and Office Online Server, so most Office environments will have at least one product line to check against the fixed build numbers below.

Technical information

Root cause

Microsoft classifies CVE-2026-118706 as a use after free in Microsoft Office Excel, mapped to CWE 416. In general terms, this weakness class occurs when software continues to reference memory after it has been freed. If an attacker can influence what occupies that memory afterward, the stale reference can be turned into control over program execution.

Microsoft has not published a code-level explanation. The advisory does not name the vulnerable component or function, and Office is closed source, so there is no public diff or commit to inspect. The advisory does describe the trigger. The bug is reached when a user converts a specially crafted workbook to a different file format using affected Office software. That points to Excel's workbook load and convert code path, but Microsoft has not confirmed the precise location.

Severity and CVSS breakdown

Microsoft assigns a CVSS 3.1 base score of 8.8 (High), with an advisory severity label of Important. The metrics are:

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality / Integrity / Availability: High / High / High
• Remediation Level: Official Fix

The Network attack vector does not mean the bug is exploitable without user action. The User Interaction: Required metric is the main constraint, and Microsoft's FAQ states explicitly that the Preview Pane is not an attack vector for this vulnerability.

Attack flow

Based on Microsoft's advisory, the exploitation scenario looks like this:

1. The attacker prepares a specially crafted Excel workbook designed to trigger the use after free.
2. The attacker delivers the workbook to the target over the network and persuades the user to work with it.
3. The user converts the crafted workbook to a different file format using affected Office software.
4. During that conversion, Excel uses freed memory, and successful exploitation results in code execution in the context of the current user.

According to Microsoft, previewing the file in the Preview Pane does not trigger the bug.

Exploitation status

At publication on November 10, 2026, Microsoft marked the issue as not publicly disclosed and not exploited, with exploitation assessed as less likely. Rapid7's November 2026 Patch Tuesday review reported the same status. A secondary tracker reported no exploitation observed as of November 10, 2026, no listing in CISA's Known Exploited Vulnerabilities catalog at that point, and no threat actor or exploit code information. No source we reviewed attributes this CVE to a named actor or campaign. This status reflects the situation at publication time and says nothing about later activity.

Known gaps

The reviewed sources do not provide a root cause analysis, the vulnerable function or component, exploit code, or reproduction details. Microsoft also does not state a CVE-specific workaround.

Patch information

Microsoft fixed CVE-2026-118706 in its November 10, 2026 Patch Tuesday release, and the MSRC advisory sets the CVSS Remediation Level to Official Fix. Because Office is closed source, the most useful patch evidence is the set of fixed build numbers. Any build below the version listed for your product is vulnerable.

Fixed builds by product

• Microsoft Office LTSC 2021 (32 bit and 64 bit): first fixed build 16.0.14334.21048, shipped as a Click to Run security update.
• Microsoft Office LTSC 2024 (32 bit and 64 bit): first fixed build 16.0.17932.21140, shipped as a Click to Run security update.
• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): fixed build depends on update channel; see Office Security Releases. Shipped as a channel-based Click to Run update.
• Microsoft Office 365 for Mac, Office LTSC for Mac 2021 and 2024: first fixed build 16.115.26110837 (Version 16.115, Build 26110837), shipped through Office for Mac and Microsoft AutoUpdate.
• Office Online Server: first fixed build 16.0.10417.20236, shipped as KB5002946.

Reading the version data

NVD's affected version data comes from Microsoft as the CNA and lists each product as affected below the fixed build. For example, Office LTSC 2021 is affected from 16.0.1 up to, but not including, 16.0.14334.21048.

Microsoft 365 Apps is serviced through several update channels (Current, Monthly Enterprise, Semi Annual), so Microsoft does not give a single build for it. Check the minimum fixed build for your channel on the Office security releases page. Do not treat the Office Online Server KB as a universal update for the other listed Office products.

Office Online Server: KB5002946

Office Online Server is the only product here that receives a traditional standalone KB package:

• The KB article explicitly lists CVE-2026-118706 among the CVEs it resolves. The package addresses Excel remote code execution and information disclosure flaws, including many related Excel CVEs in the 118xxx range.
• The package build is 16.0.10417.20236, and it requires the release version of Office Online Server to already be installed.
• It replaces the earlier security update KB5002928. Office Online Server updates are cumulative, so installing KB5002946 alone is sufficient.
• It is available through Microsoft Update (installing automatically when automatic updating is enabled), the Microsoft Update Catalog, and the Microsoft Download Center.
• The file is wacserver2019-kb5002946-fullfile-x64-glb.exe, and Microsoft publishes its SHA256 hash for verification:

F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0

What the fix likely changes

Microsoft has not released technical details of the change. As general background, not confirmed by Microsoft for this bug, use after free issues in Office file parsers are typically fixed by correcting object lifetimes: adding reference counting, nulling dangling pointers after an object is freed, or rejecting malformed records before an object can be freed and then reused. Since the trigger is workbook conversion, the fix is presumably in Excel's workbook load and convert code. Binary diffing the patched builds against the previous ones is the only way to identify the exact change.

Affected systems and versions

Per the CVE record, the following products are affected:

1. Microsoft 365 Apps for Enterprise: from version 16.0.1 before the applicable Office Security Releases update for your channel.
2. Microsoft Office 365 for Mac: from version 1.0.0 before version 16.115.26110837.
3. Microsoft Office LTSC 2021: from version 16.0.1 before version 16.0.14334.21048.
4. Microsoft Office LTSC 2024: from version 16.0.0 before version 16.0.17932.21140.
5. Microsoft Office LTSC for Mac 2021: from version 16.0.1 before version 16.115.26110837.
6. Microsoft Office LTSC for Mac 2024: from version 16.0.0 before version 16.115.26110837.
7. Office Online Server: from version 16.0.0.0 before version 16.0.10417.20236.

The vulnerable configuration requires a user to convert a specially crafted workbook to another file format using one of these products. The Preview Pane is not an attack vector.

References

• Microsoft Security Update Guide: CVE-2026-118706
• NVD: CVE-2026-118706
• CVE Program Record: CVE-2026-118706
• Microsoft Support: KB5002946
• Microsoft Support: Security update for Office Online Server, November 10, 2026 (KB5002946)
• Microsoft Office Security Releases
• Zero Day Initiative: The November 2026 Security Update Review
• Rapid7: Patch Tuesday, November 2026
• CISA Known Exploited Vulnerabilities Catalog
• Senserva: CVE-2026-118706 Office Online Server fix KB5002946
• Microsoft Security Response Center
• Microsoft Coordinated Vulnerability Disclosure Policy
• Microsoft 2026 Annual Report