Introduction
According to Microsoft's November 10, 2026 advisory, a crafted file acted on by a user in Excel on Windows, on a Mac, or through Office Online Server could let an unauthorized attacker execute code over a network. Microsoft scores CVE-2026-118712 at CVSS 3.1 base 8.8 (High) and shipped fixes the same day. Because the fix differs by deployment type, a single "Excel patch" will not cover every installation.
The weakness is an integer underflow (CWE-191). Microsoft's product severity label is Important. That label sits on a separate scale from the CVSS rating, and it should not be read as low impact. At publication, Microsoft recorded the flaw as not publicly disclosed, not exploited, and "Exploitation Less Likely". No public proof of concept has been identified.
Technical information
Root cause: CWE-191 integer underflow
MITRE defines CWE-191 as a subtraction whose result falls below the minimum allowable integer value, which produces an incorrect result. It can affect signed or unsigned integers. With unsigned arithmetic, the result wraps around to a very large number instead of going negative.
In file parsers, the pattern usually looks like this: the code subtracts one value from another, such as a record length minus a header size, or a remaining byte count minus a field offset. If an attacker-controlled field makes the second value larger than the first, the unsigned result wraps. Later code then treats that huge value as a length or index. The result is out-of-bounds memory access, which MITRE notes can cause crashes, data corruption, and, in some circumstances, buffer overflows that enable arbitrary code execution.
The standard fix for this class is to confirm that the larger operand really is larger before subtracting, or to use checked arithmetic that rejects malformed records instead of wrapping.
What Microsoft has not disclosed
Excel is closed source, and Microsoft has not published a diff, commit, or root-cause write-up. The advisory and the KB5002946 article do not name the vulnerable function, the subtraction operands, the affected file format record, or the memory corruption sequence that follows. The description above explains the weakness class. It does not reconstruct this specific bug. Any claim about the exact check Microsoft added would be speculation. The only public evidence of the fix is the updated binaries in the fixed builds.
The reviewed sources also do not establish a specific file extension, delivery channel, macro requirement, protection bypass, or the operating system privilege level of resulting code execution.
CVSS 3.1 breakdown
Published vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Attack Vector: Network (AV:N)
- Attack Complexity: Low (AC:L): no specialized access conditions or extenuating circumstances
- Privileges Required: None (PR:N): no prior authorization needed
- User Interaction: Required (UI:R): a user must take some action
- Scope: Unchanged (S:U): impact stays within the same security authority
- Confidentiality, Integrity, Availability: High (C:H/I:H/A:H)
- Temporal qualifiers: Exploit Code Maturity Unproven (E:U), Remediation Level Official Fix (RL:O), Report Confidence Confirmed (RC:C)
With the Official Fix in place, the temporal score is 7.7, down from the 8.8 base score.
Attack flow, as far as the sources support it
- An attacker prepares content that triggers the underflow in Excel's processing. The specific record or structure is not public.
- The content reaches the target over a network (AV:N). The attacker needs no privileges on the target (PR:N), and complexity is low (AC:L).
- A user must take an action (UI:R). Microsoft states that the Preview Pane is not an attack vector. Per the patch material, the vulnerable code runs only when a file is actually opened in Excel.
- During processing, a subtraction wraps, and the resulting value is used as a length or index, which is the general CWE-191 path to out-of-bounds memory access.
- Successful exploitation can yield code execution with high impact to confidentiality, integrity, and availability within the affected component.
Exploitation status at publication
- Microsoft (November 10, 2026): "Publicly disclosed: No", "Exploited: No", "Exploitation Less Likely", and exploit code maturity "Unproven".
- CISA SSVC assessment in the CVE record (November 10, 2026): exploitation "none", automatable "no", technical impact "total".
- A public tracking page updated November 10, 2026 reports no tracked public exploit code and no listing in CISA's Known Exploited Vulnerabilities catalog.
No threat actor, campaign, malware family, or indicators of compromise have been attributed to this CVE in the reviewed sources. These are dated assessments. "Exploited: No" does not guarantee that exploitation cannot occur, and a total technical impact rating can coexist with no observed exploitation.
Patch information
Microsoft fixed CVE-2026-118712 in its November 10, 2026 Patch Tuesday release. The advisory has 10 product rows, all released on November 10, 2026, and each row has its own security update. The fixed builds below are also the upper bounds in NVD's CNA-supplied affected product data, so you can verify a system by comparing its installed build with these values.
Fixed builds by product line
- Microsoft 365 Apps for Enterprise (32 bit and 64 bit): build listed in the Office security release notes. Use the entry for your installed update channel. Do not assign an LTSC or server build to Microsoft 365 Apps.
- Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140
- Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048
- Microsoft Office 365 for Mac, Office LTSC for Mac 2021, Office LTSC for Mac 2024: 16.115.26110837 (documented in the Office for Mac release notes)
- Office Online Server: 16.0.10417.20236 via KB5002946
Office Online Server: KB5002946
Office Online Server is the only server-side product in the list, so it gets its own standalone package. The KB article says the update resolves an Excel remote code execution vulnerability and an Excel information disclosure vulnerability, and lists CVE-2026-118712 among more than 50 Excel CVEs from this cycle. For change control, that means this fix cannot be installed by itself. It ships together with every other Excel parser fix released this month.
- Build: 16.0.10417.20236. Installs only on top of the release version of Office Online Server.
- Supersedes: the October 2026 update, KB5002928. Updates are cumulative, so earlier ones do not need to be installed first.
- Delivery: Microsoft Update (automatic when enabled), the Microsoft Update Catalog (search
KB5002946), or the Microsoft Download Center (download ID 108899). - Changed files: Microsoft publishes the list of updated binaries as a CSV linked from the KB article.
- Integrity check: verify the hash of any package staged offline before deployment.
File: wacserver2019-kb5002946-fullfile-x64-glb.exe SHA256: F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0
Workarounds
The advisory provides no separate workaround or alternative mitigation. The Preview Pane statement excludes one attack vector. It is no substitute for installing the update.
Affected systems and versions
Affected versions start at the listed lower bound and are earlier than the fixed build.
- Microsoft 365 Apps for Enterprise, 32 bit and 64 bit: from 16.0.1; fixed build per channel in the Office security release notes
- Microsoft Office LTSC 2021, 32 bit and 64 bit: from 16.0.1, earlier than 16.0.14334.21048
- Microsoft Office LTSC 2024, 32 bit and 64 bit: from 16.0.0, earlier than 16.0.17932.21140
- Microsoft Office 365 for Mac: from 1.0.0, earlier than 16.115.26110837
- Microsoft Office LTSC for Mac 2021: from 16.0.1, earlier than 16.115.26110837
- Microsoft Office LTSC for Mac 2024: from 16.0.0, earlier than 16.115.26110837
- Office Online Server: from 16.0.0.0, earlier than 16.0.10417.20236
Windows clients, Mac clients, and Office Online Server each need their own remediation artifact. KB5002946 is not a universal package for every affected Office installation.
Vendor security history
The Cyber Safety Review Board's report on the summer 2023 Exchange Online intrusion found that the compromise by Storm-0558, assessed to be affiliated with the People's Republic of China, was preventable. The Board described operational and strategic decisions that together indicated a culture that deprioritized enterprise security investments and rigorous risk management. Mailboxes belonging to 22 organizations and more than 500 individuals were compromised, and the Board recommended security-focused reforms, improved disclosure, and stronger transparency. That incident concerned cloud identity, not Excel, and there is no evidence linking Storm-0558 to this CVE.
Microsoft's July 10, 2026 Secure Future Initiative progress report describes its response. The report covers governance through a Deputy CISO structure, a centralized risk register, the secure-by-design, secure-by-default, and secure-in-operations principles, and continuous validation rather than periodic auditing alone. These are reforms Microsoft reports about itself, not an independent finding. For this CVE, the concrete vendor deliverable is the advisory and its product-specific updates.
References
- Microsoft Security Update Guide: CVE-2026-118712
- NVD: CVE-2026-118712
- CVE Record: CVE-2026-118712
- CVE Services API record (MITRE)
- Microsoft Support: Security update for Office Online Server, November 10, 2026 (KB5002946)
- Microsoft Learn: Release notes for Microsoft Office security updates
- Office Security Releases (aka.ms)
- MITRE CWE-191: Integer Underflow (Wrap or Wraparound)
- DHS: Cyber Safety Review Board report on the Microsoft Online Exchange incident
- CSRB: Review of the Summer 2023 Microsoft Exchange Online Intrusion (PDF)
- Microsoft Security Blog: July 2026 Secure Future Initiative progress report
- Microsoft 2026 Annual Report
- Senserva: CVE-2026-118712, Office Online Server fix KB5002946
- cve.now: CVE-2026-118712
