Brief Summary: CVE-2026-118722, a Heap-Based Buffer Overflow Enabling Remote Code Execution in Microsoft Excel

Introduction

A specially crafted spreadsheet, opened by a user, is enough to turn a memory corruption bug in Microsoft Excel into code execution on the target machine. Microsoft patched this heap-based buffer overflow, tracked as CVE-2026-118722 and scored 8.8 under CVSS 3.1, on November 10, 2026. Fixed builds cover Windows and Mac desktop Office as well as Office Online Server, which renders workbooks on the server side.

Microsoft rates the issue Important and lists it as not publicly disclosed, not exploited, and "Exploitation Less Likely". No threat actor or campaign has been tied to it in the sources we reviewed. For defenders, the practical work is mostly about build numbers. For most affected products the fix arrives as new product builds rather than standalone KBs, and a data quirk in the CVE record can mislead CPE-based scanners.

Technical Information

Root cause

The vulnerability is classified as CWE-122, a heap-based buffer overflow. Microsoft's description states that the flaw in Office Excel can allow an unauthorized attacker to execute code over a network. Beyond that, Microsoft has not said which parser or record handler contained the overflow or how it was changed. Excel is closed source, so there is no public commit or diff to review.

As general background on this bug class, heap overflow fixes usually add or correct a size or bounds check before data from a file is copied into a heap buffer. Microsoft has not confirmed that this is what changed for CVE-2026-118722. Anyone who wants the specifics would need to diff the pre-patch and post-patch Excel binaries. The file manifest CSV linked from KB5002946 is the closest public view of which binaries were modified.

CVSS breakdown

Microsoft publishes the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• AV:N (Network attack vector) and AC:L (Low attack complexity)
• PR:N: no privileges required
• UI:R: user interaction is required, because the victim must open the file
• S:U: scope unchanged
• C:H / I:H / A:H: High impact to confidentiality, integrity, and availability
• E:U / RL:O / RC:C: exploit code maturity unproven, Official Fix available, report confidence confirmed

The base score is 8.8. The temporal metrics, in particular Remediation Level set to Official Fix ("a complete vendor solution is available"), bring the temporal score to 7.7.

Attack flow

Based on Microsoft's FAQ and the attack conditions above, exploitation would proceed as follows:

1. The attacker prepares a specially crafted spreadsheet designed to trigger the heap overflow when Excel processes it.
2. The file is delivered to the target from outside the organisation, typically as an email attachment, a download, or a shared link.
3. The user deliberately opens the file in Excel. Microsoft states the Preview Pane is not an attack vector, so a file that is only previewed in Outlook or Explorer does not meet the trigger condition Microsoft describes.
4. Processing the crafted content overflows a heap buffer, and successful exploitation results in code execution with High impact to confidentiality, integrity, and availability.

Microsoft does not describe the exploitation primitive, the affected file structures, or how code execution is achieved, so we do not speculate on those details here.

Patch Information

Microsoft shipped the fix on November 10, 2026 (Patch Tuesday). The fix is delivered as new product builds, so version numbers are what matter. The advisory, the CVE record and NVD give the same version boundaries, and any build at or above the number below is patched.

Fixed builds by product line

• Office Online Server: 16.0.10417.20236, delivered as KB5002946 (MSI-style security update)
• Microsoft Office LTSC 2021 (32 and 64 bit): 16.0.14334.21048, delivered as a Click to Run update
• Microsoft Office LTSC 2024 (32 and 64 bit): 16.0.17932.21140, delivered as a Click to Run update
• Office LTSC for Mac 2021 and 2024, Office 365 for Mac: 16.115.26110837, delivered through the Mac update channel (see the Office for Mac release notes)
• Microsoft 365 Apps for Enterprise (32 and 64 bit): depends on channel (see aka.ms/OfficeSecurityReleases), delivered as a Click to Run channel update

Microsoft 365 Apps has no single fixed number. Its affected range in the CVE record ends at a URL (https://aka.ms/OfficeSecurityReleases) instead of a version, because each update channel (Current, Monthly Enterprise, Semi Annual) gets its own patched build. Check the build for each channel on Microsoft's security release notes page rather than comparing against one fixed value.

Why only one KB article appears

Microsoft's "November 2026 updates for Microsoft Office" index lists just two downloadable KBs: SharePoint Server Subscription Edition (KB5002945) and Office Online Server (KB5002946). The desktop products affected here (LTSC 2021 and 2024, Microsoft 365 Apps, Mac) are serviced through Click to Run or the Mac update channel and do not get standalone MSI KBs. If you only check KB numbers, you can miss most of the fix.

KB5002946 (Office Online Server)

Office Online Server renders Excel workbooks on the server, so it gets its own package:

• Build: 16.0.10417.20236. The release version of Office Online Server must already be installed.
• Scope: The KB lists CVE-2026-118722 among more than 50 Excel remote code execution and information disclosure CVEs fixed in the same package. One install covers the whole November Excel set on that server.
• Supersedence: It replaces the previous security update, KB5002928.
• Where to get it: Microsoft Update (automatic), the Microsoft Update Catalog (search KB5002946), or the Microsoft Download Center.
• File manifest: Microsoft publishes a CSV of every file the update changes, linked from the KB.
• Package integrity: Verify the hash of a manually downloaded copy before deployment:

File:   wacserver2019-kb5002946-fullfile-x64-glb.exe
SHA256: F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0

Verifying the patch

Because the fix lives in the build, verification means comparing builds. In Excel on Windows, go to File > Account > About Excel. On Mac, use Excel > About Excel. On Office Online Server, check the installed product version. A build below the threshold is still vulnerable, whatever Windows Update reports for the OS.

A data quirk to watch for

The CNA's CPE applicability block in the CVE record has an extra entry that labels the Office Online Server threshold (16.0.10417.20236) with an office_2021:...:ltsc CPE string. The human-readable affected list, NVD and MSRC all tie 16.0.10417.20236 to Office Online Server only and give Office LTSC 2021 the threshold 16.0.14334.21048. If your scanner reads CPEs, it may flag LTSC 2021 against the wrong build. Use the MSRC security updates table as the authoritative source.

Detection Methods

No signatures exist for CVE-2026-118722 at the time of writing. No Snort, YARA, Sigma or nuclei signature built for this flaw was found in the usual rule feeds. Cisco Talos published Snort 2 rules (SIDs 1:67439 through 1:67484) and Snort 3 rules (SIDs 1:301734 through 1:301751) for this Patch Tuesday, but they cover Windows kernel, Print Spooler, HTTP.sys, Shell and other escalation of privilege bugs. None is for an Excel CVE, and the Talos coverage list leaves this CVE out. OffSeq Threat Radar reports no indexed public nuclei template and no attack traffic recorded by its Mirage honeypot sensors. Detection therefore relies on behaviour and exposure tracking.

1. Focus on the trigger

Since the attack only works when a user opens a crafted file, and the Preview Pane is not an attack vector:

• An exploitation attempt should appear as a user deliberately opening a spreadsheet, usually one from outside the organisation (email attachment, download or shared link).
• Telemetry about files that were only previewed in Outlook or Explorer is lower priority for this CVE.
• Email gateway, web proxy and file origin data (for example, Mark of the Web) are where the document can be found before it is opened.

2. Watch what Excel does after a document opens

A heap overflow leading to code execution usually shows itself through what the Excel process does next. CVE Brief recommends watching endpoint logs for unusual processes started by Excel.exe and investigating suspicious network traffic tied to documents. Build or tune EDR detections for:

• Unusual child processes of excel.exe: script interpreters, command shells or living-off-the-land binaries started by Excel rarely belong in normal spreadsheet work.
• Network connections from excel.exe to unfamiliar hosts right after a file opens, which can indicate a second-stage payload download.
• Unexpected file writes or privilege changes by the Excel process, such as dropping executables or touching persistence locations.
• Excel crashes, especially repeated crashes or Windows Error Reporting events for excel.exe linked to a particular file. A failed or unstable heap corruption exploit often crashes the application.

3. Use EDR exploit behaviour detections

CVE Brief also suggests using EDR tools to catch heap spraying and other exploitation techniques. Make sure memory exploit protections and Office-related attack surface or behaviour rules are enabled and actually monitored, not left in audit mode with nobody reviewing alerts. These detections are generic, but they target the technique this bug needs.

4. Find exposed hosts by build number

Query software inventory or vulnerability scanners for Office builds older than:

• Office LTSC 2021: 16.0.14334.21048
• Office LTSC 2024: 16.0.17932.21140
• Office for Mac (Microsoft 365 and LTSC 2021/2024): 16.115.26110837
• Office Online Server: 16.0.10417.20236
• Microsoft 365 Apps for Enterprise: per channel, via aka.ms/OfficeSecurityReleases

Hosts with older builds deserve more attention under the behavioural detections above. Keep checking Talos and Snort advisories and public Sigma and YARA rule sets, since rules specific to this CVE may appear if a proof of concept or real-world exploitation emerges.

Affected Systems and Versions

NVD lists the following affected ranges. "Before" means versions below the stated endpoint are affected.

• Microsoft 365 Apps for Enterprise: from 16.0.1, before the channel-specific build listed at aka.ms/OfficeSecurityReleases (no single numeric endpoint)
• Microsoft Office 365 for Mac: from 1.0.0, before 16.115.26110837
• Microsoft Office LTSC 2021: from 16.0.1, before 16.0.14334.21048
• Microsoft Office LTSC 2024: from 16.0.0, before 16.0.17932.21140
• Microsoft Office LTSC for Mac 2021: from 16.0.1, before 16.115.26110837
• Microsoft Office LTSC for Mac 2024: from 16.0.0, before 16.115.26110837
• Office Online Server: from 16.0.0.0, before 16.0.10417.20236

The vulnerable configuration is any of these builds where a user opens an attacker-supplied spreadsheet. Note the CPE quirk described above for Office LTSC 2021.

Vendor Security History

Microsoft's FY2026 Form 10-K reports revenue growth of $19.2 billion, or 16%, and growth of $14.2 billion, or 16%, in Microsoft 365 Commercial products and cloud services revenue, which gives a sense of how widely the productivity stack that includes Excel is deployed. For track record context, the CISA Cyber Safety Review Board reviewed a separate Summer 2023 Microsoft Exchange Online intrusion. Its report details the operational and strategic decisions that led to the intrusion and makes recommendations for industry and government. That incident is unrelated to CVE-2026-118722 and is noted only as background.

References

• Microsoft Security Update Guide: CVE-2026-118722
• NVD: CVE-2026-118722
• Official CVE record (CVEProject cvelistV5 JSON)
• Microsoft Support: Security update for Office Online Server, November 10, 2026 (KB5002946)
• Microsoft Support: November 2026 updates for Microsoft Office
• Microsoft Learn: Release notes for Microsoft Office security updates
• Zero Day Initiative: The November 2026 Security Update Review
• CVE Brief: CVE-2026-118722
• OffSeq Threat Radar: CVE-2026-118722
• Snort: Talos Rules 2026-11-10
• Cisco Talos: Microsoft Patch Tuesday for November 2026
• CISA: The KEV Catalog
• CISA: CSRB Report on Summer 2023 Microsoft Online Exchange Incident
• CSRB: Review of the Summer 2023 Microsoft Exchange Online Intrusion (PDF)
• Microsoft FY2026 Form 10-K