Quick Look: Microsoft Excel CVE-2026-118725 Out-of-Bounds Read Leading to Elevation of Privilege

Introduction

Microsoft's November 10, 2026 Patch Tuesday release fixed an out-of-bounds read in Excel that the vendor classifies as elevation of privilege, carrying a CVSS 3.1 base score of 8.8. The affected products include Microsoft 365 Apps for Enterprise, Office LTSC on Windows and Mac, and Office Online Server, so remediating CVE-2026-118725 touches both desktop fleets and server infrastructure, each with its own version boundary.

This summary covers what Microsoft has disclosed about the flaw, how to read its CVSS vector without overstating the risk, which builds contain the fix, and where the public record ends. Several details here are easy to misread, so we keep the vendor's qualifications intact throughout.

Technical information

Root cause

Microsoft describes the issue as follows: an out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to elevate privileges over a network. The MSRC advisory, the CVE record, and NVD all map it to CWE-125: Out of Bounds Read.

MITRE defines CWE-125 as reading data past the end, or before the beginning, of the intended buffer. At the weakness-class level, typical consequences include disclosure of sensitive memory, exposure of memory addresses useful for other attacks, crashes, and other unexpected behavior. These are generic outcomes for the class. None of them has been demonstrated for this particular Excel bug.

Excel is closed source, so there is no public commit or diff. Fixes for this class of bug generally validate an index, offset, or length taken from file content against the real size of the buffer before using it. Because Microsoft ties the bug to dragging a print area boundary in Page Break Preview, the fix most likely sits in code that converts print area or page break coordinates into memory lookups. Microsoft has not confirmed that detail, and the Security Update Guide API lists no affected binaries for this CVE (affectedBinaries is empty for every product).

What remains undisclosed:

• The vulnerable function or module
• The erroneous offset or length calculation
• The workbook structure that triggers the read
• The mechanism that converts the invalid read into the stated elevation of privilege outcome

We found no vulnerable code published in any reviewed source, so none is reproduced here.

Reading the CVSS vector

The vector supplied by Microsoft as CNA (NVD had not added its own assessment in the reviewed record):

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector: Network. Microsoft describes delivering a crafted workbook to a user, rather than attacking an unattended network service.
• Attack Complexity: Low.
• Privileges Required: None. This describes the attacker's starting position, not the privileges gained.
• User Interaction: Required. The disclosed sequence needs several deliberate user actions.
• Scope: Unchanged.
• Confidentiality, Integrity, Availability: High. These are impact ratings. They are not evidence that every attempt achieves every outcome.

The temporal score is 7.7, and the temporal vector includes RL:O (Remediation Level: Official Fix). Microsoft's own maximum severity rating is Important, not Critical. CVSS and Microsoft's severity scale are different systems, and both should be preserved when reporting this CVE.

Attack flow

Based on Microsoft's FAQ, the disclosed scenario is:

1. The attacker prepares a specially crafted Excel workbook.
2. The attacker delivers it to a target and convinces the recipient to act on it.
3. The user opens the workbook for editing.
4. The user edits a cell.
5. The user drags a print area boundary in Page Break Preview.
6. On success, the attacker obtains the privileges of the user or service account running the affected process. Microsoft specifically mentions gaining the permissions of the user running Excel.

Two clarifications matter for exposure assessment. First, Microsoft states that the Preview Pane is not an attack vector. Page Break Preview and the Preview Pane are different features. Second, the advisory does not establish automatic administrator or SYSTEM access, and it does not describe a server-specific exploitation workflow for Office Online Server, even though that product is in scope for the fix.

Exploitation status

Microsoft's exploitability assessment, explicitly labeled as of original publication:

• Publicly disclosed: No
• Exploited: No
• Exploitability: Exploitation Less Likely
• Exploit maturity: Unproven (no public exploit code, or a theoretical exploit)

No reviewed source names a victim, malware family, campaign, or threat actor using this CVE. It is not among the six vulnerabilities CISA added to the Known Exploited Vulnerabilities Catalog on November 10, 2026. The exploited Outlook spoofing flaw CVE-2026-124194 discussed in Qualys's November review is a separate issue, and its status does not carry over to this one.

Patch information

Microsoft fixed CVE-2026-118725 in the November 10, 2026 Patch Tuesday release. The Security Update Guide API marks every affected product "productStatus":"fixed" and "customerActionRequired":true, meaning protection depends on installing the update.

Fixed builds by product

• Office LTSC 2024 (32 and 64 bit): 16.0.17932.21140 (Version 2408), Click to Run volume licensed
• Office LTSC 2021 (32 and 64 bit): 16.0.14334.21048 (Version 2108), Click to Run volume licensed
• Office Online Server: 16.0.10417.20236 via KB5002946
• Microsoft Office 365 for Mac, Office LTSC for Mac 2021, Office LTSC for Mac 2024: 16.115.26110837, per the Office for Mac release notes
• Microsoft 365 Apps for Enterprise (32 and 64 bit): November 10, 2026 channel builds listed below

Microsoft 365 Apps channel builds

MSRC gives no single build number for Microsoft 365 Apps and points to the November 10, 2026 Office security release notes, which list this CVE under Excel:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office 2024 and Office 2021 Retail: Version 2610 (Build 20527.20196)

Office Online Server (KB5002946)

The server fix is a single cumulative package, build 16.0.10417.20236. It requires the release version of Office Online Server and replaces the earlier security update KB5002928. Microsoft offers it through Microsoft Update (installed automatically when automatic updating is enabled), the Microsoft Update Catalog (search KB5002946), and the Microsoft Download Center. For package verification, the KB lists:

wacserver2019-kb5002946-fullfile-x64-glb.exe
SHA256: F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0

The KB summary text mentions only an Excel remote code execution flaw and an Excel information disclosure flaw, yet CVE-2026-118725 appears in its list of covered advisories. The same package also addresses many other Excel CVEs from the same batch, for example CVE-2026-118703 through CVE-2026-118732. The reviewed KB content does not state a restart requirement.

Verifying the fix

With no source change to review, confirmation is by build number:

• Windows: in any Office app, open File > Account > About and confirm the build is at or above the number for your channel.
• Mac: open Excel > About Excel and look for 16.115.26110837 or later.
• Office Online Server: confirm KB5002946 (build 16.0.10417.20236) is installed.

Office updates are cumulative, so any later monthly build also includes this fix. We did not find any CVE-specific registry workaround, configuration change, or compensating control in the vendor material, so the update is the remediation.

Affected systems and versions

The CVE record lists the following ranges, with the upper bound excluded from the affected range:

• Microsoft 365 Apps for Enterprise: from 16.0.1 up to the referenced Office security release (see channel builds above)
• Microsoft Office 365 for Mac: from 1.0.0 up to, but not including, 16.115.26110837
• Microsoft Office LTSC 2021: from 16.0.1 up to, but not including, 16.0.14334.21048
• Microsoft Office LTSC 2024: from 16.0.0 up to, but not including, 16.0.17932.21140
• Microsoft Office LTSC for Mac 2021: from 16.0.1 up to, but not including, 16.115.26110837
• Microsoft Office LTSC for Mac 2024: from 16.0.0 up to, but not including, 16.115.26110837
• Office Online Server: from 16.0.0.0 up to, but not including, 16.0.10417.20236

Windows LTSC, Mac, and Office Online Server each use a different version boundary, so a single blanket Office version check will not cover every deployment. These ranges do not by themselves establish that other Office editions are affected.

Vendor security history

Microsoft is the vendor and assigning CNA. Its documented history includes the summer 2023 Exchange Online intrusion attributed to Storm-0558, which the US Cyber Safety Review Board found preventable. The Board concluded that Microsoft's security culture required an overhaul and recommended stronger identity and credential controls along with improved logging and disclosure practices. In its July 2026 Secure Future Initiative report, Microsoft states that three objectives reached their target state, three were nearing completion, and twelve made significant progress. These are vendor-reported figures, not an independent evaluation.

Separately, the UK Competition and Markets Authority opened a strategic market status investigation into Microsoft's business software ecosystem, noting more than 15 million commercial users in the UK, with a final decision scheduled for February 2027. That is a competition matter rather than a security finding. None of this history implies any connection between Storm-0558 or other actors and CVE-2026-118725.

References

• NVD: CVE-2026-118725
• CVE Record: CVE-2026-118725
• MSRC Security Update Guide: CVE-2026-118725
• MSRC Security Update Guide API: affected products for CVE-2026-118725
• Release notes for Microsoft Office security updates
• Office Security Releases (aka.ms link)
• KB5002946: Security update for Office Online Server
• KB5002946 servicing page
• Update history for Office for Mac
• MITRE CWE-125: Out of Bounds Read
• Tenable: Security Updates for Microsoft Office Products (November 2026)
• Qualys: Microsoft Patch Tuesday, November 2026 Security Update Review
• CISA Adds Six Known Exploited Vulnerabilities to Catalog (November 10, 2026)
• CISA Known Exploited Vulnerabilities Catalog
• Stefan Gossner: SharePoint security fixes released with November 2026 PU
• CMA launches strategic market status investigation into Microsoft's business software ecosystem
• CMA case page: Microsoft's business software ecosystem
• DHS: Cyber Safety Review Board report on the Summer 2023 Exchange Online incident
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion (PDF)
• Microsoft SFI Progress Report July 2026
• Microsoft Excel product page