Introduction
Microsoft's November 10, 2026 Patch Tuesday release closed a heap-based buffer overflow in Excel that an attacker can reach by getting a user to open a crafted Office file. The same flaw spans Microsoft 365 Apps, Office LTSC on Windows and Mac, and Office Online Server, so defenders have several distinct update paths to track for a single CVE, each with its own fixed build.
Technical information
Root cause
Microsoft describes CVE-2026-118715 as a heap-based buffer overflow in Microsoft Office Excel that allows an unauthorized attacker to elevate privileges over a network. The assigned weakness is CWE-122: Heap based Buffer Overflow. MITRE defines this class as writing past the end of a buffer allocated on the heap, and lists general consequences such as crashes and, in some circumstances, arbitrary code execution. Those consequences describe the weakness class as a whole. None of them is a confirmed outcome for this specific bug.
Excel is closed source, and Microsoft has not published root cause details. The reviewed material does not disclose the vulnerable function, the document structure involved, the heap layout, corruption offsets, or exploitation reliability. For this class of bug, a fix usually adds or corrects a bounds check in parsing code, so that a size or count field taken from the file can no longer cause a write past the end of a heap buffer. We treat that as background on the bug class rather than a description of Microsoft's actual code change.
Scoring
Microsoft, acting as CNA, published the following CVSS 3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Base score: 8.8 (High)
- Temporal score: 7.7
- Microsoft product severity: Important
NVD lists the record as Undergoing Enrichment. The 8.8 score it displays is Microsoft's CNA assessment, and NIST has not supplied its own.
The metrics break down as follows:
- AV:N (Network): the attacker can operate remotely, for example by sending the file.
- AC:L (Low): no specialized access conditions are specified.
- PR:N (None): the attacker needs no prior authorization.
- UI:R (Required): a user must act. Microsoft's FAQ specifies opening the malicious Office file.
- S:U (Unchanged): impact stays within the same security authority.
- C:H, I:H, A:H: high confidentiality, integrity, and availability impact.
Low attack complexity does not remove the user interaction requirement. The two metrics measure different things.
Attack flow
Based on Microsoft's advisory, the documented sequence is:
- The attacker prepares a malicious Office file.
- The attacker sends the file to the target over a network.
- The attacker persuades the recipient to open the file in a vulnerable Excel build.
- Processing the file triggers the heap overflow in the affected Excel process.
- Successful exploitation could grant the attacker the privileges of the user account or service account running that process.
The advisory puts two limits on that sequence. First, Microsoft explicitly says the Preview Pane is not an attack vector, so the Network classification should not be read as an exposed service that can be compromised without user participation. Second, the elevation of privilege label is bounded by Microsoft's own account context. The advisory does not promise administrator or SYSTEM access, only the privileges of the account running the affected process.
Patch information
Microsoft fixed CVE-2026-118715 in its November 10, 2026 Patch Tuesday release. The Security Update Guide sets Remediation Level to Official Fix (RL:O), meaning a complete vendor fix has shipped. At publication Microsoft said the bug was neither publicly disclosed nor exploited and rated exploitation as Less Likely. Microsoft credits the researcher yhw with the report.
There is no public commit or diff. The fix ships only as updated binaries, and you are protected only if your build is at or above the fixed build for your product line.
Fixed builds by product
From the MSRC advisory, which matches the affected version ranges on NVD:
- Microsoft Office LTSC 2021 (32-bit and 64-bit):
16.0.14334.21048 - Microsoft Office LTSC 2024 (32-bit and 64-bit):
16.0.17932.21140 - Microsoft Office 365 for Mac, Office LTSC for Mac 2021 and 2024:
16.115.26110837(Version 16.115) - Office Online Server: KB5002946, build
16.0.10417.20236 - Microsoft 365 Apps for Enterprise (32-bit and 64-bit): Click to Run channel builds, for which MSRC points to
https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps (Click to Run)
These installs have no single KB. The fix arrives through each update channel's November 10, 2026 build, and Microsoft's Release notes for Microsoft Office security updates page lists CVE-2026-118715 for that date. The builds below were obtained through an automated extraction step rather than read directly, so confirm them on that page before relying on them:
- Current Channel: Version 2610 (Build 20527.20196)
- Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
- Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
Compare against the build number shown under File > Account > About Excel. Any build at or above the one listed for your channel and version includes the fix.
Office for Mac
The Office for Mac release notes list CVE-2026-118715 under Excel security updates for Version 16.115 (Build 26110837). That single build covers Microsoft 365 for Mac and both Mac LTSC editions, and it is delivered through Microsoft AutoUpdate (in an Office application, Help > Check for Updates). Administrators can also deploy application update packages with existing deployment tooling.
Office Online Server (KB5002946)
KB5002946 is a standard MSI-style servicing package. Notable details from the KB page:
- It is a cumulative Excel rollup listing dozens of November CVEs, including neighbouring Excel bugs CVE-2026-118714, CVE-2026-118716, CVE-2026-118717, and CVE-2026-118718. Installing it fixes all of them together.
- The KB summary describes its fixes as Excel remote code execution and information disclosure issues, while MSRC labels CVE-2026-118715 as Elevation of Privilege. The CVE is explicitly listed in the KB, so the mismatch is in wording only and coverage is the same.
- It replaces the earlier update KB5002928.
- It requires the release version of Office Online Server to already be installed.
- It is available through Microsoft Update, the Microsoft Update Catalog (search
KB5002946), or the Download Center (download ID 108899). - The KB lists a SHA256 hash for the x64 full file package, which you can check before deployment:
F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0
Verifying the fix
No source-level patch exists to diff, so check the installed build number against the thresholds above. NVD records every version below these thresholds as affected. For Office Online Server, for example, the range is:
16.0.0.0 < 16.0.10417.20236
Microsoft did not publish a CVE-specific workaround, so the supported corrective action is the applicable update.
Affected systems and versions
Per the MSRC advisory and the CVE record, versions earlier than the following fixed builds are affected:
- Microsoft Office LTSC 2021, 32-bit and 64-bit: builds below
16.0.14334.21048 - Microsoft Office LTSC 2024, 32-bit and 64-bit: builds below
16.0.17932.21140 - Microsoft Office LTSC for Mac 2021: builds below
16.115.26110837 - Microsoft Office LTSC for Mac 2024: builds below
16.115.26110837 - Microsoft Office 365 for Mac: builds below
16.115.26110837 - Office Online Server: versions from
16.0.0.0up to, but not including,16.0.10417.20236 - Microsoft 365 Apps for Enterprise, 32-bit and 64-bit: builds prior to the November 10, 2026 security build for the relevant update channel and version (see the Microsoft 365 Apps channel list above)
The vulnerable configuration in every case is a user opening a crafted Office file in an affected Excel build. Microsoft assigns the same Elevation of Privilege label and Important severity across all affected product rows and does not publish a separate platform-specific severity.
Vendor security history
The briefing materials provide some vendor context. The Cyber Safety Review Board's review of the summer 2023 Exchange Online intrusion attributed the compromise of Microsoft's cloud environment to Storm 0558, an actor associated with the government of the People's Republic of China, and described access to official email accounts of senior United States officials. The Board concluded the intrusion was preventable, found Microsoft's security culture inadequate, and recommended greater transparency about known and unknown incident facts. This is historical context only and is unrelated to attribution for this Excel bug.
Microsoft's July 2026 Secure Future Initiative report describes its stated response: 99.97% phishing-resistant MFA coverage, removal of public access from 732,000 resources, decommissioning of 1.4 million unused Entra applications, remediation of more than 550,000 instances of critical and high-risk open source vulnerabilities, and automated container patching addressing about 3 million vulnerability instances each month. These are Microsoft's reported program outcomes. None of them is an independently demonstrated protection against this flaw. In our reading, the relevant concrete response for CVE-2026-118715 is the published product update.
References
- NVD entry for CVE-2026-118715
- CVE.org record for CVE-2026-118715
- Microsoft Security Update Guide: CVE-2026-118715
- Microsoft Support: KB5002946 for Office Online Server
- Microsoft Support: Description of the security update for Office Online Server, November 10, 2026 (KB5002946)
- Microsoft Learn: Release notes for Microsoft Office security updates
- Microsoft Learn: Release notes for Office for Mac
- MITRE CWE-122: Heap based Buffer Overflow
- FIRST CVSS v3.1 Specification Document
- cve.now entry for CVE-2026-118715
- Senserva: CVE-2026-118715 Office Online Server fix KB5002946
- VulDB entry for CVE-2026-118715
- Microsoft 2026 Annual Report
- CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft Secure Future Initiative Progress Report, July 2026
