Brief Summary: Microsoft Excel CVE-2026-118721 Heap-Based Buffer Overflow Leading to Remote Code Execution

Introduction

Microsoft's November 10, 2026 Patch Tuesday release fixed a heap-based buffer overflow in Excel that can let an attacker run code as the user who opens a crafted workbook and starts typing a formula. The affected products include Microsoft 365 Apps for Enterprise, Office LTSC on Windows and Mac, Office 365 for Mac, and Office Online Server, so fixing CVE-2026-118721 involves Windows desktops, Macs, and server farms. Each of these uses a different update procedure.

One note on the source data: the CVE feed lists the vendor as Unknown. The vendor and CNA is Microsoft.

Technical information

Root cause

The assigned weakness is CWE-122, Heap based Buffer Overflow. MITRE defines this class as writing beyond the end of a buffer allocated on the heap. In general, the consequences of this class range from crashes to arbitrary code execution, for example when the overflow corrupts adjacent memory such as function pointers. That is a description of the class. Nothing in the sources confirms which Excel structure is corrupted in this CVE.

Excel is closed source. Microsoft has not published the vulnerable function, the malformed workbook structure, the offending formula, memory offsets, a root cause writeup, or a code diff. None of the reviewed sources contain a code snippet. A heap overflow of this kind is usually fixed by adding or correcting a length or bounds check before data is copied into a heap buffer that was sized too small. For this CVE, that is our inference, and Microsoft has not confirmed it. The only way to know exactly what changed would be to diff the patched and unpatched Excel binaries.

Attack flow

Microsoft's advisory describes a specific attack sequence:

1. The attacker prepares a specially crafted Excel workbook. The attacker does not need an account on the target system.
2. The attacker delivers the workbook to the victim.
3. The attacker persuades the victim to open the workbook for editing.
4. The victim begins typing a formula. This is the trigger Microsoft documents.
5. The heap overflow is triggered, and successful exploitation executes code with the permissions of the user running Excel.

Several details narrow the exposure:

• Microsoft states the Preview Pane is not an attack vector.
• The exploitation description identifies formula entry as the trigger. It does not identify saving the workbook as the trigger.
• The advisory does not establish automatic elevation to administrator or SYSTEM. Code runs in the context of the Excel user. The CVSS assessment still rates confidentiality, integrity, and availability impact as High.

CVSS scoring

Microsoft, as CNA, scored the issue as follows. NVD shows this score as Microsoft's and has not published its own assessment.

Base:     CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H              (8.8 High)
Temporal: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C (7.7)

• Attack Vector: Network. The workbook can be delivered remotely. This does not remove the need for the victim to act.
• Attack Complexity: Low, and Privileges Required: None.
• User Interaction: Required. The victim must edit the workbook and start entering a formula.
• Scope: Unchanged, with High confidentiality, integrity, and availability impact.
• Temporal metrics: exploit maturity Unproven (E:U), Remediation Level Official Fix (RL:O, which Microsoft defines as "a complete vendor solution is available"), and report confidence Confirmed (RC:C). These metrics lower the base score of 8.8 to a temporal score of 7.7.

Microsoft's own product severity rating is Important. CVSS High and Microsoft Important come from two different rating systems, so they do not contradict each other.

Exploitability status

At original publication, Microsoft reported Publicly disclosed: No, Exploited: No, and Exploitation Less Likely. The OffSeq Threat Radar record reports:

• no exploit indexed in Metasploit or Exploit DB
• no CISA KEV listing
• no source reporting exploitation
• no attack traffic recorded by its Mirage sensors

No threat actor, campaign, or indicator has been tied to this CVE in the reviewed sources. Microsoft credits Jeongmin Choi (@lmksecurity) for reporting the issue. All of these are dated observations from specific sources. They are not proof that exploitation is impossible.

Patch information

Microsoft fixed CVE-2026-118721 in its November 10, 2026 Patch Tuesday release. The fix ships in Microsoft's regular cumulative Office updates, not as a separate hotfix. Zero Day Initiative's November 2026 review lists this CVE as one of more than 60 Excel CVEs fixed in the same release, so the update that fixes this bug also fixes related Excel memory corruption bugs.

Fixed builds

These builds come from the MSRC Security Updates table and match the CNA data in NVD:

• Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048
• Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140
• Microsoft Office 365 for Mac, Office LTSC for Mac 2021, Office LTSC for Mac 2024: 16.115.26110837
• Office Online Server: 16.0.10417.20236 (KB5002946)
• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): no single build number. MSRC points to aka.ms/OfficeSecurityReleases.

Microsoft 365 Apps channel builds

Microsoft 365 Apps ships through several update channels, so the fix arrives in a different build on each one. The Office security update release notes, updated November 10, 2026, list CVE-2026-118721 under Excel with these November builds:

• Current Channel: Version 2610, Build 20527.20196
• Monthly Enterprise Channel: 2610 (20527.20194), 2609 (20430.20264), and 2608 (20326.20320)
• Office 2021/2024 Retail: Version 2610, Build 20527.20196
• Office LTSC volume licensed editions: 14334.21048 and 17932.21140, the same builds listed above

The same page also lists Semi Annual Enterprise Channel builds 20527.20192, 20430.20262, and 20326.20318. If you run that channel, check these against the live page before relying on them.

Delivery and deployment

• Windows Click to Run installs (Microsoft 365 Apps, LTSC) receive the new build through the normal Office update channel. Where the controls are available, Microsoft directs users to File > Account > Update Options > Update Now. If Update Options is missing, the install is probably managed through volume licensing or Group Policy. In that case, updates come through Microsoft Update or the organization's help desk.
• Mac installs receive build 16.115.26110837 through Microsoft AutoUpdate: Help > Check for Updates, then Update or Update All, then restart the application.
• Office Online Server needs a separate package, tracked as KB5002946 and linked from the MSRC advisory. When we fetched the KB article link, it returned a 404, so use the MSRC download link instead.

Updating an Office Online Server farm

Microsoft's Office Online Server documentation states that automatic updates are unsupported for these farms. Applying updates automatically can cause document viewing or editing to fail, or force a farm rebuild.

• Single-server farm: record the existing farm configuration, remove the server from the farm, install the update, restart if prompted, and recreate the farm with the same settings. Office Online is unavailable to users during this process, so schedule it for off hours.
• Multiple-server farm: remove one server from the load balancer and the farm, update it, and use it to start an updated farm. Then move the remaining servers through the same process one at a time. Shift traffic to the updated farm once it has enough capacity to carry the load.

Verifying the fix

CVE Ledger tags the MSRC advisory as both vendor-advisory and patch, which makes the advisory the authoritative patch source. To confirm an install is fixed, open the product's About dialog and compare the Office or Excel build number with the builds above. Any build at or above the listed number includes the fix. Microsoft documents no CVE-specific configuration workaround. The remedy is the security update.

Affected systems and versions

Based on the MSRC Security Updates table and the CNA data in NVD, these products are affected when running builds earlier than the listed first fixed build:

• Microsoft 365 Apps for Enterprise, 32 bit and 64 bit: builds earlier than the November 10, 2026 security build for the installed channel (for example, Current Channel builds earlier than Version 2610 Build 20527.20196)
• Microsoft Office LTSC 2021, 32 bit and 64 bit: builds earlier than 16.0.14334.21048
• Microsoft Office LTSC 2024, 32 bit and 64 bit: builds earlier than 16.0.17932.21140
• Microsoft Office 365 for Mac: builds earlier than 16.115.26110837
• Microsoft Office LTSC for Mac 2021: builds earlier than 16.115.26110837
• Microsoft Office LTSC for Mac 2024: builds earlier than 16.115.26110837
• Office Online Server: builds earlier than 16.0.10417.20236 (KB5002946)

These fixed builds apply only to their own products. For example, KB5002946 updates Office Online Server and does not patch desktop Excel installations.

Vendor security history

The most widely cited recent example of Microsoft's security track record is the 2023 Exchange Online intrusion. The Cyber Safety Review Board concluded that it resulted from a cascade of Microsoft security failures, and its report describes compromised mailboxes across 22 organizations and over 500 individuals. The DHS summary called the intrusion preventable and said Microsoft's decisions reflected a culture that deprioritized enterprise security investment and rigorous risk management. The Board recommended that Microsoft publicly share a plan, with specific timelines, for fundamental security reforms.

Microsoft's response includes the Secure Future Initiative. Its July 2026 progress report describes applying Zero Trust principles across platform controls, engineering pipelines, and governance, and states that security work is continuous rather than finished. The Exchange incident involved cloud identity infrastructure, not Excel, and does not imply any link between that incident's actor and this vulnerability.

References

1. Microsoft Security Update Guide: CVE-2026-118721
2. NVD entry for CVE-2026-118721
3. CVE Record: CVE-2026-118721
4. CVE Ledger: CVE-2026-118721
5. Zero Day Initiative: The November 2026 Security Update Review
6. Release notes for Microsoft Office security updates
7. KB5002946: Security update for Office Online Server, November 10, 2026
8. Apply software updates to Office Online Server
9. How to update Microsoft 365 or Office for Windows
10. Update Microsoft 365 or Office on macOS or iOS
11. MITRE CWE-122: Heap based Buffer Overflow
12. OffSeq Threat Radar: CVE-2026-118721
13. Tenable Nessus plugin 378503: Security Updates for Microsoft Office Products (November 2026)
14. Senserva: CVE-2026-118721 Office Online Server fix KB5002946
15. Stefan Goßner: SharePoint security fixes released with November 2026 PU
16. CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
17. DHS: Cyber Safety Review Board Releases Report on Microsoft Online Exchange Incident
18. Microsoft Secure Future Initiative Progress Report, July 2026
19. Microsoft 2026 Annual Report