Overview of CVE-2026-118717: Stack-Based Buffer Overflow Enabling Code Execution in Microsoft Excel

Introduction

One crafted spreadsheet, opened by one user, is the documented trigger for a stack-based buffer overflow in Microsoft Office Excel that Microsoft patched on November 10, 2026. The flaw carries a CVSS v3.1 base score of 8.8 with High confidentiality, integrity, and availability impact. It spans Windows desktop editions, Mac editions, and Office Online Server, so no single package covers every installation.

Two severity labels apply. The CVSS v3.1 rating is High (8.8), while Microsoft's own product severity is Important. They come from different rating systems, and neither one makes this a Critical issue. At original publication, Microsoft's exploitability assessment listed Publicly disclosed: No, Exploited: No, and Exploitation Less Likely, and the temporal metrics record exploit code maturity as Unproven. Senserva separately reports that the CVE was not in the CISA Known Exploited Vulnerabilities catalog and had no observed exploitation as of November 10, 2026. No threat actor, campaign, or indicator set has been associated with it. These assessments are dated and guarantee nothing about later activity.

Technical information

Root cause

Microsoft describes CVE-2026-118717 as a stack-based buffer overflow in Excel that allows an unauthorized attacker to execute code over a network, classified as CWE-121. MITRE defines CWE-121 as writing beyond the end of a buffer allocated on the stack. In this weakness class, overwriting security-sensitive stack data, including a stored return address, can redirect execution. Crashes and other availability effects are also possible.

Those are generic mechanisms for the bug class. Excel is closed source, and Microsoft has not disclosed the vulnerable function, the affected file structure, the overflow length, payload construction, or a working exploitation procedure. CWE-121 bugs in file parsers commonly arise when attacker-controlled data from a file record is copied into a fixed-size stack buffer without a length check, and fixes typically add a size check or a bounded copy. That is background on the class. It does not describe Microsoft's actual code or code change. No vulnerable code has been published, so we do not reproduce any here.

CVSS breakdown

The base vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector: Network and Attack Complexity: Low
• Privileges Required: None (the attacker's starting position, not the privilege level of code after exploitation)
• User Interaction: Required (a user must open the crafted file)
• Scope: Unchanged
• Confidentiality, Integrity, Availability: High
• Base score 8.8, temporal score 7.7, Remediation Level Official Fix, Exploit Code Maturity Unproven

The advisory does not state the privilege level of the resulting code, so administrator access or a chained privilege escalation should not be assumed.

Attack flow

Based on what Microsoft has published, the documented sequence is short:

1. The attacker prepares a specially crafted file designed to trigger the stack overflow in Excel.
2. The attacker supplies that file to a target. The CVSS attack vector is Network, but the advisory does not name a specific delivery channel.
3. The user opens the file. Microsoft states explicitly that the Preview Pane is not an attack vector, and the advisory does not describe a separate save step or a requirement to enable macros.
4. Processing the crafted content overflows a stack buffer, which can lead to code execution. The advisory describes the result only as remote code execution.

Read the word remote alongside UI:R. No attack that works without user action has been demonstrated, and opening the file is the relevant exposure point.

Patch information

Microsoft fixed CVE-2026-118717 in its November 10, 2026 security release. The MSRC advisory sets the temporal Remediation Level to Official Fix, meaning Microsoft has shipped a complete fix for every affected product line. No workaround or partial fix is listed. Because the fix ships as new Excel binaries, the only way to confirm it is present is to check build numbers.

Fixed builds by product

• Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048
• Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140
• Microsoft Office 365 for Mac, Office LTSC for Mac 2021 and 2024: 16.115.26110837
• Office Online Server: 16.0.10417.20236 (KB5002946)
• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): Click to Run channel builds listed at aka.ms/OfficeSecurityReleases

NVD's affected ranges end just below these builds (for example, LTSC 2021 is affected below 16.0.14334.21048). Any install at or above the listed build has the fix.

Office Online Server: KB5002946

For server deployments, the fix is security update KB5002946, build 16.0.10417.20236, available through Microsoft Update, the Microsoft Update Catalog, or the Microsoft Download Center. Details that matter for deployment:

• It is a cumulative Excel rollup. CVE-2026-118717 is one of dozens of Excel remote code execution and information disclosure CVEs it fixes, alongside related entries such as CVE-2026-118716 and CVE-2026-118718 through CVE-2026-118732.
• It replaces the October 2026 update, KB5002928. Only the latest package is needed.
• It can only be installed on top of the release version of Office Online Server.
• The standalone package is wacserver2019-kb5002946-fullfile-x64-glb.exe, and Microsoft publishes its SHA256 hash for integrity verification before installation:

F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0

When automatic updating is enabled, Microsoft says the update downloads and installs automatically. The support article does not specify a restart requirement or a farm upgrade sequence.

Click to Run and Mac channels

Microsoft 365 Apps and the LTSC desktop editions are serviced through Click to Run, which pulls the fixed Excel binaries on the normal update channel. Mac editions receive the fix in build 16.115.26110837, listed in the Office for Mac release notes. On these platforms, applying the patch comes down to confirming that the installed build is at or above the fixed build listed earlier.

The advisory credits Haein Lee of KAIST Hacking Lab with reporting the bug through coordinated disclosure, which is why the fix shipped on the same day the CVE was published with nothing disclosed beforehand.

Affected systems and versions

Per the Microsoft-supplied affected product data in NVD (upper bounds are exclusive):

• Microsoft 365 Apps for Enterprise: starting at 16.0.1; the upper boundary points to Microsoft's Office security releases rather than a single numeric build
• Microsoft Office LTSC 2021: 16.0.1 up to, but not including, 16.0.14334.21048
• Microsoft Office LTSC 2024: 16.0.0 up to, but not including, 16.0.17932.21140
• Microsoft Office 365 for Mac: 1.0.0 up to, but not including, 16.115.26110837
• Microsoft Office LTSC for Mac 2021: 16.0.1 up to, but not including, 16.115.26110837
• Microsoft Office LTSC for Mac 2024: 16.0.0 up to, but not including, 16.115.26110837
• Office Online Server: 16.0.0.0 up to, but not including, 16.0.10417.20236

The vulnerable configuration is any of these products below its fixed build where a user can open an attacker-supplied file. Previewing in the Preview Pane is not documented as a trigger.

Vendor security history

Microsoft Corporation is both the affected vendor and the CNA for this record. Its 2026 Annual Report cites 6% growth in Microsoft 365 Commercial paid seats and 7% growth in Microsoft 365 Consumer subscribers in fiscal 2026. These are adoption growth figures, not market share data.

The most substantive outside review of Microsoft's security practices is the Cyber Safety Review Board's report on the summer 2023 Exchange Online intrusion. The Board found the intrusion preventable, described a cascade of avoidable Microsoft errors, concluded that Microsoft's security culture was inadequate and required an overhaul, and called for stronger accountability, logging, and transparency. That was a separate cloud incident and says nothing about the root cause of this Excel bug.

Microsoft's response, the Secure Future Initiative, is documented in a July 2026 progress report that claims outcomes such as decommissioning 1.4M unused Entra applications and remediating more than 550,000 critical and high-risk open-source vulnerability instances. Those are Microsoft's own program-level claims. For CVE-2026-118717 specifically, the concrete customer-facing outcome is the advisory and the shipped fixes.

References

• NVD: CVE-2026-118717
• CVE Record: CVE-2026-118717
• Microsoft Security Update Guide: CVE-2026-118717
• Microsoft Support: KB5002946
• Microsoft Support: Security update for Office Online Server, November 10, 2026 (KB5002946)
• Microsoft Learn: Release notes for Microsoft Office security updates
• MITRE CWE-121: Stack Based Buffer Overflow
• Senserva: CVE-2026-118717 entry
• Qualys: Microsoft Patch Tuesday, November 2026 Security Update Review
• Cisco Talos: Microsoft Patch Tuesday for November 2026
• Stefan Goßner: SharePoint security fixes released with November 2026 PU
• Cyber Safety Review Board: Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft Trust Center: SFI Progress Report July 2026
• Microsoft 2026 Annual Report
• Microsoft Form 10K, fiscal 2026