Brief Summary: Microsoft Excel CVE-2026-118730 Use After Free Leading to Remote Code Execution

Introduction

Microsoft's November 10, 2026 Patch Tuesday release fixed a use after free in Microsoft Office Excel that can lead to code execution when a user opens a specially crafted file. The fix spans Microsoft 365 Apps, Office LTSC 2024 and 2021, Office for Mac, and Office Online Server, so it reaches a broad set of Office deployments even though Microsoft rated exploitation as less likely.

Technical information

Root cause

Microsoft's public description of CVE-2026-118730 is a single sentence: "Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network." The issue is classified as CWE 416, which MITRE defines as a product reusing or referencing memory after it has been freed.

Excel is closed source, so there is no public commit, diff, or root cause write-up for this bug. We can only describe how this class of bug generally looks in Office. The file parser frees an internal object while a stale pointer to that object is still in use, and later code dereferences the stale pointer. Fixes for this pattern usually tighten object lifetime in one of a few ways:

• reference counting on the affected object
• clearing or invalidating pointers after the object is freed
• rechecking an object's state after a callback that can tear it down

Microsoft has not said which approach it used for CVE-2026-118730, and no vulnerable code has been published. Determining the actual root cause would require diffing Excel binaries from before and after the November 2026 update. That work is harder because the same update bundles 56 Excel CVEs, so any diff will contain a large amount of unrelated change.

Scoring

Microsoft publishes the following CVSS 3.1 vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• Base score: 8.8 (Microsoft maximum severity: Critical)
• Temporal score: 7.7, reduced by Exploit Code Maturity Unproven (E:U), Remediation Level Official Fix (RL:O), and Report Confidence Confirmed (RC:C)
• Attack Vector Network, Attack Complexity Low, Privileges Required None: the attacker needs no account or prior access
• User Interaction Required: Microsoft states the attacker must convince a user to open a specially crafted file
• Impact: High for confidentiality, integrity, and availability

Two details narrow the attack surface. A user has to open the file, so this is not a zero-click issue. Microsoft also explicitly states that the Preview Pane is not an attack vector.

Attack flow

Based on Microsoft's advisory, exploitation follows this sequence:

1. The attacker builds a specially crafted file that drives Excel into the use after free condition.
2. The attacker gets the file to the target. Microsoft does not specify a delivery channel, and we do not infer one here.
3. The victim opens the file in an unpatched Excel build. Previewing the file in the Preview Pane is not sufficient, according to Microsoft.
4. Excel references memory that has already been freed, which Microsoft says can allow the attacker to execute code, with high impact to confidentiality, integrity, and availability.

No exploit chain or post-exploitation behavior has been documented in the sources we reviewed.

Exploitation status

At publication, Microsoft marked the issue as not publicly disclosed and not exploited, with an exploitability assessment of less likely. Cisco Talos also listed it among the vulnerabilities Microsoft considered less likely to be exploited, and did not report exploitation in the wild. No threat actor, campaign, or public exploit is associated with this CVE in the available reporting. That reflects the state of public information and is no guarantee about future exploitation.

Patch information

Microsoft fixed CVE-2026-118730 in its November 10, 2026 Patch Tuesday release. The Security Update Guide lists a Remediation Level of Official Fix, described as "a complete vendor solution is available." Every affected product has a fixed build. There is no separate hotfix or standalone Excel binary. The fix ships inside the normal Office servicing update for each product line.

Fixed builds by product

• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): November 10, 2026 channel builds listed below, delivered as a Click to Run channel update (MSRC points to aka.ms/OfficeSecurityReleases)
• Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140 (Version 2408), volume licensed Click to Run update
• Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048 (Version 2108), volume licensed Click to Run update
• Office 365 for Mac, Office LTSC for Mac 2021 and 2024: 16.115 (Build 26110837), via Microsoft AutoUpdate or the Mac release
• Office Online Server: 16.0.10417.20236, via KB5002946 (download ID 108899)

Microsoft 365 Apps channel builds

The release notes for the November 10, 2026 security update list CVE-2026-118730 under the Excel heading for these builds:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: 2610 (Build 20527.20194), 2609 (Build 20430.20264), 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel: 2610 (Build 20527.20192), 2609 (Build 20430.20262), 2608 (Build 20326.20318)
• Office 2024 and 2021 Retail: Version 2610 (Build 20527.20196)

The Office for Mac release notes also list CVE-2026-118730 among the Excel fixes in Version 16.115 (Build 26110837), released November 10, 2026.

Verifying the fix

Compare the installed build against the fixed builds above:

• Windows: File > Account > About Excel
• Mac: Excel > About Excel
• Office Online Server: the installed product version

Any build at or above the listed number contains the fix. On Click to Run channels, read channel and build together. A Monthly Enterprise device on Version 2609 needs at least Build 20430.20264, not the Current Channel build number.

For Office Online Server, Microsoft Support states that the release version of Office Online Server must already be installed for KB5002946 to apply, and that the update is available through Microsoft Update, automatic updating, the Microsoft Update Catalog, and the Microsoft Download Center. The KB article at support.microsoft.com/help/5002946 returned a 404 during our review, so the fixed build number and download link above come from Microsoft's Security Update Guide entry. No separate workaround is documented.

Affected systems and versions

The CVE record expresses affected ranges as "below this build":

• Office LTSC 2024 (32 bit and 64 bit): builds below 16.0.17932.21140
• Office LTSC 2021 (32 bit and 64 bit): builds below 16.0.14334.21048
• Office 365 for Mac, Office LTSC for Mac 2021 and 2024: versions below 16.115 (Build 26110837)
• Office Online Server: builds below 16.0.10417.20236
• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): builds below the November 10, 2026 build for the device's channel and version:
  • Current Channel, Version 2610: below Build 20527.20196
  • Monthly Enterprise Channel: Version 2610 below Build 20527.20194, Version 2609 below Build 20430.20264, Version 2608 below Build 20326.20320
  • Semi Annual Enterprise Channel: Version 2610 below Build 20527.20192, Version 2609 below Build 20430.20262, Version 2608 below Build 20326.20318
• Office 2024 and 2021 Retail: Version 2610 below Build 20527.20196

The only configuration requirement for exploitation documented by Microsoft is that a user opens the crafted file in an affected build. The Preview Pane alone does not trigger the issue.

Vendor security history

This CVE arrived alongside 55 other Excel CVEs in the same November 2026 update, which says a lot about how much file-parsing attack surface Excel continues to carry. On the program side, Microsoft's July 2026 Secure Future Initiative progress report states that the company had remediated more than 550,000 instances of critical and high-risk open source vulnerabilities, that automated container patching addressed about 3 million vulnerability instances each month, and that Microsoft had published 1,989 CVEs with CWE and CPE annotations. These are Microsoft's own reported metrics rather than an independent assessment, and they do not speak to this specific Excel flaw. Microsoft also runs the Microsoft Security Vulnerability Research program as a channel for sharing security knowledge with the broader ecosystem.

References

• NVD entry for CVE-2026-118730
• Microsoft Security Update Guide: CVE-2026-118730
• Microsoft 365 Apps security update release notes
• Office for Mac release notes
• Microsoft Support: Security update for Office Online Server, November 10, 2026 (KB5002946)
• Cisco Talos: Microsoft Patch Tuesday for November 2026
• Zero Day Initiative: The November 2026 Security Update Review
• CrowdStrike: November 2026 Patch Tuesday Updates and Analysis
• MITRE CWE 416: Use After Free
• Microsoft Secure Future Initiative Progress Report, July 2026
• Microsoft 2026 Form 10K
• Microsoft Security Vulnerability Research
• Senserva CVE summary for CVE-2026-118730