Quick Look: CVE-2026-118707, a Heap-Based Buffer Overflow in Microsoft Excel Leading to Remote Code Execution

Introduction

Excel workbooks are among the files enterprises exchange most routinely, so memory corruption in how Excel processes them keeps coming back as a concern for defenders. CVE-2026-118707, fixed in Microsoft's November 10, 2026 Patch Tuesday release, is a heap-based buffer overflow that can lead to remote code execution when a user opens a specially crafted workbook. It spans Microsoft 365 Apps, Office LTSC on Windows and Mac, and Office Online Server.

Technical information

Root cause

The recorded weakness is CWE 122, a heap-based buffer overflow. Microsoft's advisory states only that a heap buffer can be overrun when a user opens a specially crafted file. It does not identify which parsing routine, record type, or workbook feature is responsible.

Excel is closed source, so there is no source diff or commit to examine. The fix ships as updated binaries, and no public binary diff has been published. Overflows of this class are typically fixed by correcting a size or length check, or the allocation arithmetic, before data is copied into a heap buffer. That is an inference from the bug class, and Microsoft has not confirmed the root cause. Anyone who wants to see the exact change would need to diff the Excel binaries from before and after the patch.

Severity and vector

The CVSS 3.1 base score is 8.8 (High), while Microsoft labels the maximum severity Important. The vector components are:

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector: Network, meaning the malicious file can reach the target remotely
• Attack Complexity: Low
• Privileges Required: None, meaning the attacker is unauthorized
• User Interaction: Required, meaning the victim must open the file and interact with it
• Scope: Unchanged
• Confidentiality, Integrity, Availability: High

A network vector paired with required user interaction makes this remote code execution, but not something Microsoft describes as an unattended attack.

Attack flow

Based on Microsoft's description, exploitation proceeds as follows:

1. The attacker builds a specially crafted Excel workbook designed to overrun a heap buffer during processing. The specific feature or structure that triggers the overflow has not been disclosed.
2. The attacker delivers the workbook to a target and uses social engineering to convince the user to open it in Excel.
3. The user opens the workbook and interacts with the affected workbook features.
4. The overflow corrupts heap memory, which Microsoft states can allow the attacker to execute code.

Microsoft explicitly states that the Preview Pane is not an attack vector, so previewing the file without opening it in Excel is not described as sufficient to trigger the bug.

Available sources do not describe a memory layout, an exploit chain, or a working proof of concept.

Exploitation status

At publication, Microsoft marked the flaw as not publicly disclosed and not exploited, and rated it Exploitation Less Likely. The OffSeq Threat Radar record likewise reports no evidence of exploitation in the wild, no CISA Known Exploited Vulnerabilities listing, no public exploit code in Metasploit or Exploit DB, and no attack traffic observed by its sensors. OffSeq labels its evidence thin and cautions that missing evidence is not evidence of safety. No threat actor has been attributed.

Patch information

Microsoft fixed CVE-2026-118707 in the November 10, 2026 Patch Tuesday release. MSRC sets the CVSS temporal metric Remediation Level to Official Fix, meaning Microsoft considers the vendor fix complete. No workaround or interim hotfix is needed first, and no separate workaround is documented.

Fixed builds by product

MSRC and the NVD affected products data agree on the build at which each product line stops being vulnerable. Any build at or above these numbers is patched:

• Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048
• Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140
• Office Online Server: 16.0.10417.20236 (KB5002946)
• Microsoft Office 365 for Mac, Office LTSC for Mac 2021, Office LTSC for Mac 2024: 16.115.26110837
• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): No single fixed number in MSRC. The build depends on the update channel, and MSRC links to the Office security releases page.

The Microsoft 365 Apps security release notes associate the following November 10, 2026 builds with this CVE:

• Current Channel: version 2610 build 20527.20196
• Monthly Enterprise Channel: version 2610 build 20527.20194, version 2609 build 20430.20264, version 2608 build 20326.20320
• Semi Annual Enterprise Channel: version 2610 build 20527.20192, version 2609 build 20430.20262, version 2608 build 20326.20318

Microsoft 365 Apps and Office LTSC updates are delivered through Click to Run, with release notes on the Microsoft 365 Apps security updates page. Mac builds are listed in the Office for Mac release notes.

Office Online Server: KB5002946

Office Online Server is the one affected product with a classic standalone KB package. KB5002946 (build 16.0.10417.20236) explicitly lists CVE-2026-118707. It is a cumulative Excel update that also fixes about 57 other CVEs, most of them sibling Excel remote code execution and information disclosure bugs (CVE-2026-118700 through CVE-2026-118732 and others). Deployment details:

• Prerequisite: The release version of Office Online Server must already be installed.
• Supersedence: It replaces the earlier update KB5002928, so only KB5002946 needs to be installed.
• Where to get it: Microsoft Update (automatic when automatic updating is enabled), the Microsoft Update Catalog, or the Microsoft Download Center (download ID 108899).
• Verifying the package: Check the published SHA256 before deploying, especially when staging packages offline. Microsoft also publishes a CSV listing every file in the update, which is useful for identifying which binaries changed.

Installer: wacserver2019-kb5002946-fullfile-x64-glb.exe
SHA256:    F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0

Bundled fixes

One update addresses dozens of related Excel memory-safety CVEs, so installing the November 2026 build for your channel fixes this bug and its siblings together. CVE-2026-118707 cannot be patched on its own.

Affected systems and versions

The CVE record lists the following product families as affected. Builds below the listed fixed version are vulnerable:

• Microsoft 365 Apps for Enterprise, 32 bit and 64 bit: builds prior to Current Channel 2610 build 20527.20196; Monthly Enterprise Channel 2610 build 20527.20194, 2609 build 20430.20264, or 2608 build 20326.20320; Semi Annual Enterprise Channel 2610 build 20527.20192, 2609 build 20430.20262, or 2608 build 20326.20318
• Microsoft Office LTSC 2021, 32 bit and 64 bit: versions prior to 16.0.14334.21048
• Microsoft Office LTSC 2024, 32 bit and 64 bit: versions prior to 16.0.17932.21140
• Office Online Server: versions prior to 16.0.10417.20236
• Microsoft Office 365 for Mac, Office LTSC for Mac 2021, Office LTSC for Mac 2024: versions prior to 16.115.26110837

The vulnerable configuration requires a user to open a crafted workbook in Excel and interact with affected workbook features. The Preview Pane alone is not an attack vector.

References

• NVD: CVE-2026-118707
• CVE Record: CVE-2026-118707
• Microsoft Security Update Guide: CVE-2026-118707, Microsoft Office Excel Remote Code Execution Vulnerability
• Microsoft Support: Security update for Office Online Server, November 10, 2026 (KB5002946)
• Microsoft Learn: Release notes for Microsoft Office security updates
• Microsoft Office Security Releases
• OffSeq Threat Radar: CVE-2026-118707
• Qualys: Microsoft Patch Tuesday, November 2026 Security Update Review
• Microsoft Security Response Center
• GOV.UK: CMA launches strategic market status investigation into Microsoft's business software ecosystem
• Reuters: UK competition regulator targets Microsoft's business software grip