Introduction
Microsoft describes CVE-2026-118718 as a crafted Excel workbook plus one ordinary edit, ending in attacker code running with the victim's privileges. The flaw is a heap-based buffer overflow fixed in the November 10, 2026 release. Because the affected products span Microsoft 365 Apps, perpetual Office editions on Windows and Mac, and Office Online Server, remediation reaches both endpoint fleets and server farms.
This post is a brief summary of the public disclosure. It sticks to what Microsoft, the CVE record, NVD, and a few trackers actually say, and it flags where the public record stops.
Technical information
Root cause
Microsoft classifies the flaw as CWE-122, Heap-based Buffer Overflow. In that weakness class, a product writes beyond the end of a buffer allocated on the heap. The label names a category of memory-safety failure. It does not reconstruct Excel's specific implementation error. Excel is closed source, and Microsoft has not named the vulnerable routine.
The advisory does not disclose:
- The vulnerable function or code path
- The allocation size involved
- The workbook record structure or exact file format used
- The internal relationship between row deletion and the overflow
- Any working exploit
The disclosure alone cannot establish a detailed corruption or control-flow sequence.
The documented trigger: deleting a row
Microsoft's FAQ is unusually specific. An attacker must convince a user to open a specially crafted workbook in an affected version of Excel and then delete a row. Successful exploitation could execute code with that user's privileges.
Two details in the FAQ affect triage:
- The Preview Pane is not an attack vector. According to Microsoft, passive preview does not trigger the bug.
- The required action after opening is row deletion. Saving the workbook is not the trigger.
Microsoft describes this as a possible scenario. It is not drawn from a reported intrusion.
Reading the CVSS vector
The base vector supplied by the Microsoft CNA is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack Vector: Network, remote attack context is recorded
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required, a user must take action
- Scope: Unchanged
- Confidentiality, Integrity, Availability: High
The network vector does not cancel the separate user interaction requirement or the workbook and row deletion prerequisites. NVD displays this 8.8 High score from Microsoft but has not yet provided an independent NIST score, and it marks the record as undergoing enrichment.
Microsoft also publishes an extended vector with temporal metrics:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
That yields a temporal score of 7.7, which is distinct from the 8.8 base score and should not replace it. The MSRC advisory's own severity label is Important rather than Critical, even though the CVSS rating is High.
Attack flow
Based only on Microsoft's FAQ, the sequence looks like this:
- The attacker prepares a specially crafted Excel workbook. Its internal structure is not publicly documented.
- The attacker persuades a target to open it. The advisory does not specify a delivery channel.
- The target opens the workbook in an affected version of Excel.
- The target deletes a row in the workbook.
- Excel writes past the end of a heap buffer, and successful exploitation could result in code execution with the target user's privileges.
Exploitation status
- Microsoft's original publication records Exploited: No, Publicly disclosed: No, and Exploitation Less Likely.
- Exploit code maturity is Unproven, meaning no publicly available exploit code or an exploit that remains theoretical.
- The cve.now tracker reports no tracked public exploit and no CISA KEV listing at its last read, and notes that vendors or researchers can report attacks before CISA lists them.
- No threat actor or campaign is identified in the CVE-specific disclosures.
- Qualys and Cisco Talos both identify CVE-2026-124194, an Outlook issue, as the vulnerability reported exploited in the November 2026 release. That does not imply exploitation of this Excel bug.
- Microsoft credits Jeongmin Choi (@lmksecurity) with the report. This acknowledges a researcher and does not identify an attacker.
The evidence supports no reported active exploitation at publication. That is a narrower claim than saying exploitation has never occurred.
Patch information
Microsoft fixed CVE-2026-118718 in its November 10, 2026 Patch Tuesday release. Excel is closed source, so there is no public commit or diff. The fix ships only as updated binaries. The temporal metric RL:O (Remediation Level: Official Fix) indicates Microsoft considers the vendor fix complete.
What the fix likely targets
Microsoft has not said which internal routine it changed. The trigger still points at where the defect sits. Deleting a row makes Excel shift, resize, or reallocate the heap structures that hold cell, row, and formula data. A malformed workbook can make those structures inconsistent with the sizes Excel expects, and the overflow happens when Excel then writes past the end of a heap buffer. Fixes for CWE-122 usually add or correct bounds and length checks before such writes, or validate parsed structures before use. This description is our inference from the trigger and the weakness class. Microsoft has not published it.
Fixed builds by product
From the MSRC Security Updates table and the NVD affected version ranges:
- Microsoft 365 Apps for Enterprise (32-bit and 64-bit): Click to Run channel build listed in the Office security release notes
- Office LTSC 2024 (32-bit and 64-bit):
16.0.17932.21140 - Office LTSC 2021 (32-bit and 64-bit):
16.0.14334.21048 - Office 365 for Mac, Office LTSC for Mac 2021 and 2024:
16.115.26110837 - Office Online Server:
16.0.10417.20236via KB5002946
Any build below these thresholds is vulnerable. Desktop Click to Run installs receive the fix through normal Office channel updates. Mac installs receive it through Microsoft AutoUpdate or the version listed in the Mac release notes.
Updating Office for Windows
Microsoft directs users to open an Office application and select File > Account > Update Options > Update Now. They may need to select Enable Updates first. If Update Options is missing, the installation may be volume licensed or managed through Group Policy. In that case, Microsoft advises using Microsoft Update or contacting the organization's help desk.
Office Online Server package (KB5002946)
Office Online Server is the only product here with a standalone, MSI-style patch:
- Package:
wacserver2019-kb5002946-fullfile-x64-glb.exe - SHA256:
F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0 - Build: 16.0.10417.20236
- Prerequisite: the release version of Office Online Server must already be installed
- Supersedes: KB5002928
- Where to get it: Microsoft Update, the Microsoft Update Catalog, or the Download Center (download ID 108899)
KB5002946 is a rollup. Besides CVE-2026-118718, it lists more than 50 other Excel remote code execution and information disclosure CVEs from the same release, including the neighboring IDs CVE-2026-118700 through CVE-2026-118732. Installing the one package fixes all of them on Office Online Server, and they cannot be patched individually.
Deploying to an Office Online Server farm
The KB includes generic automatic-update language, but Microsoft's dedicated Office Online Server guidance states that automatically applying updates is unsupported. Incorrect updating can prevent users from viewing or editing documents and may require rebuilding the farm.
- Single-server farm: remove the server from the farm, apply the update, and recreate the farm with its original configuration. Office Online is unavailable during this work, so Microsoft recommends noncritical or nonbusiness hours.
- Multiple-server farm: update an initial server, create the updated farm, then process the remaining servers individually. Move traffic to the updated farm once it has sufficient capacity, and restart servers if prompted.
Microsoft Update delivers the package, but it does not give you a safe deployment procedure.
Protected View is not a workaround
Microsoft describes Protected View as read only, with most editing functions disabled, and advises staying there unless the file's source and content are trusted. That is general guidance. The CVE advisory publishes no specific mitigation or workaround, so treat the product updates as the remediation.
Verifying the fix
With no code change to inspect, confirm remediation by build number. Check that each Office installation reports a build at or above the thresholds listed earlier. For Office Online Server, also confirm KB5002946 appears as installed, and match the downloaded package against the published SHA256 hash before deployment.
Affected systems and versions
From the CVE record and NVD (lower bound included, upper bound excluded):
- Microsoft 365 Apps for Enterprise: from 16.0.1, with the upper boundary delegated to Office security releases. The CVE record specifies no single numeric fix.
- Microsoft Office 365 for Mac: from 1.0.0 before 16.115.26110837
- Microsoft Office LTSC 2021: from 16.0.1 before 16.0.14334.21048
- Microsoft Office LTSC 2024: from 16.0.0 before 16.0.17932.21140
- Microsoft Office LTSC for Mac 2021: from 16.0.1 before 16.115.26110837
- Microsoft Office LTSC for Mac 2024: from 16.0.0 before 16.115.26110837
- Office Online Server: from 16.0.0.0 before 16.0.10417.20236
The vulnerable configuration per Microsoft is a user opening a crafted workbook in one of these versions and deleting a row. Windows fixes do not establish the update state of Mac installations, so each platform needs its own verification.
Vendor security history
The Cyber Safety Review Board's review of the 2023 Microsoft Exchange Online intrusion attributed it to Storm-0558, associated with the government of the People's Republic of China, and concluded that it succeeded because of a cascade of avoidable Microsoft security failures. The Board found that Microsoft did not independently detect the compromise of its sensitive cryptographic material (a customer reported anomalies) and that Microsoft's security culture required an overhaul. That incident involved Exchange Online and cloud authentication. It is not evidence that Storm-0558 exploited CVE-2026-118718.
Microsoft's July 2026 Secure Future Initiative progress report describes embedding security across engineering, governance, and culture, and reports:
- Centrally governed build templates for 93% of critical and high-value build pipelines
- More than 550,000 critical and high-risk open-source vulnerability instances remediated
- More than 100 new detections introduced
These figures are self-reported and describe a broader program. They do not show that any individual affected installation has received this fix.
References
- Microsoft Security Update Guide: CVE-2026-118718
- NVD: CVE-2026-118718
- CVE Record: CVE-2026-118718
- Microsoft Support: Security update for Office Online Server, November 10, 2026 (KB5002946)
- Microsoft Learn: Release notes for Microsoft Office security updates
- Microsoft Learn: Apply software updates to Office Online Server
- Microsoft Support: How to update Microsoft 365 or Office for Windows
- Microsoft Support: What is Protected View?
- MITRE CWE-122: Heap based Buffer Overflow
- cve.now: CVE-2026-118718
- Senserva: CVE-2026-118718 Office Online Server fix KB5002946
- Cisco Talos: Microsoft Patch Tuesday for November 2026
- Qualys: Microsoft Patch Tuesday, November 2026 Security Update Review
- Stefan Gossner: SharePoint security fixes released with November 2026 PU
- CSRB: Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft Trust Center: SFI Progress Report July 2026
- GOV.UK: CMA strategic market status investigation into Microsoft's business software ecosystem
