Brief Summary: Microsoft Excel CVE-2026-118731 Stack-Based Buffer Overflow Leading to Remote Code Execution

Introduction

Microsoft's November 10, 2026 security release fixed a stack-based buffer overflow in Excel that can give an attacker code execution in the context of whoever opens and interacts with a crafted workbook. The affected product list spans Microsoft 365 Apps, Office LTSC on both Windows and Mac, and Office Online Server, so no single package covers every exposed system, and remediation has to be matched product by product.

The flaw carries a CVSS 3.1 base score of 8.8 (High), assigned by Microsoft as CNA, while Microsoft's own severity rating is Important. The two numbers come from different rating systems and do not conflict. Microsoft reports no exploitation and no public disclosure at the time of publication.

Technical Information

Root cause

MSRC describes CVE-2026-118731 as a stack-based buffer overflow in Microsoft Office Excel that allows an unauthorized attacker to execute code over a network, and maps it to CWE-121. MITRE defines that weakness as writing past the end of a buffer allocated on the stack. Its general consequences include application crashes and arbitrary code execution, but those are properties of the weakness class. Microsoft has not published the specific memory corruption primitive, the vulnerable function, the workbook structures involved, or any field values that trigger the bug.

What the advisory FAQ does provide is an unusually specific trigger path, and that path tells us roughly where the bug lives. The overflow is reached through the number formatting logic behind an embedded chart's datasheet. When the user changes the decimal count on a datasheet cell, the code that rebuilds that cell's number format writes into a fixed-size buffer on the stack, and data from the attacker's workbook can make that write run past the end of the buffer.

Microsoft has not described the code change. Our inference, which Microsoft has not confirmed, is that the fix adds length or bounds checks, or replaces the fixed stack buffer, in the routine that regenerates a cell's number format when the decimal count changes.

Attack flow

Based on the MSRC advisory, the documented exploitation sequence is:

1. The attacker builds a crafted workbook containing an embedded chart.
2. The attacker delivers the workbook to the victim. The CVSS vector allows a network attacker with no prior privileges.
3. The victim opens the workbook in an affected Office version.
4. The victim activates the embedded chart in that workbook.
5. The victim runs Decrease Decimal on a cell in the chart's datasheet.
6. The stack buffer overflow occurs. On successful exploitation, attacker-controlled code runs with the victim user's privileges.

Two points matter for scoping. First, Microsoft explicitly states that the Preview Pane is not an attack vector, which fits a bug that only fires after explicit user actions. Second, simply opening the file is not the complete published sequence. The chart activation and Decrease Decimal steps are part of the documented trigger. Treat this as an interaction-dependent vulnerability, not an interaction-free network compromise.

The public advisory does not include workbook construction details, a payload, or a reproducible exploit, so the available evidence supports analysis of prerequisites and impact rather than a reconstruction of the exploit chain.

CVSS breakdown

The base vector published by NVD (sourced from Microsoft as CNA, with no independent NIST assessment) is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• AV:N: remote exploitation is possible.
• AC:L: no specialized access conditions are required.
• PR:N: the attacker needs no prior authorization.
• UI:R: a separate user must participate, matching the trigger sequence above.
• S:U: impact stays within the same security authority.
• C:H / I:H / A:H: potentially serious loss of confidentiality, integrity, and availability.

Requiring no attacker privileges is not the same as requiring no victim interaction, and neither implies execution as administrator. The stated execution context is the user's privileges.

Microsoft also publishes a temporal score of 7.7:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Here E:U means Exploit Code Maturity is Unproven, RL:O means an Official Fix is available, and RC:C means the report is Confirmed.

Exploitation status

At original publication, Microsoft's exploitability assessment lists:

• Publicly disclosed: No
• Exploited: No
• Exploitability: Exploitation Less Likely

The CVE does not appear in CISA KEV catalog version 2026.11.10, and the reviewed sources identify no threat actor, campaign, or CVE-specific indicators of compromise. Qualys' November 2026 review discusses an exploited Outlook spoofing vulnerability, CVE-2026-124194, in the same release. That is a different vulnerability in a different component, and its exploitation status should not be transferred to this Excel CVE. These observations reflect publication time and do not guarantee anything about later activity.

Patch Information

Microsoft fixed CVE-2026-118731 in its November 10, 2026 Patch Tuesday release, and the MSRC advisory sets the temporal Remediation Level to Official Fix. Excel is closed source, so there is no public commit or diff. The evidence for the fix is the set of patched builds and KB packages. The fix is bundled with a large batch of other Excel fixes from the same month, so it cannot be installed on its own. ZDI's November 2026 review lists it as an Important-rated Excel RCE with no out-of-band or emergency patch. The normal monthly update is the fix.

Microsoft has not published a separate workaround or configuration change for this CVE, so macro settings, registry changes, or Preview Pane changes should not be presented as fixes.

Fixed builds by product

Anything below the listed build is vulnerable.

• Office Online Server: 16.0.10417.20236, shipped as KB5002946 through Microsoft Update, the Microsoft Update Catalog, and the Microsoft Download Center.
• Office LTSC 2024 (32-bit and 64-bit): 16.0.17932.21140 (Version 2408), Click to Run security update.
• Office LTSC 2021 (32-bit and 64-bit): 16.0.14334.21048 (Version 2108), Click to Run security update.
• Microsoft 365 Apps for Enterprise (32-bit and 64-bit): per-channel builds listed below, Click to Run channel update.
• Office 365 for Mac, Office LTSC for Mac 2024, Office LTSC for Mac 2021: 16.115.26110837, Office for Mac update.

Microsoft 365 Apps channel builds

For Microsoft 365 Apps, MSRC points to aka.ms/OfficeSecurityReleases rather than one build number. The Office security release notes list CVE-2026-118731 under Excel for the November 10, 2026 release:

• Current Channel: Version 2610, Build 20527.20196
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office 2024 and Office 2021 Retail: Version 2610, Build 20527.20196

Office Online Server package (KB5002946)

This is the one product with a separate downloadable package, and deploying desktop Office updates does not remediate it.

• It is a cumulative Excel security rollup whose CVE list includes CVE-2026-118731 alongside dozens of other Excel RCE and information disclosure CVEs from the same month.
• It moves the server to build 16.0.10417.20236 and replaces the earlier KB5002928.
• The release version of Office Online Server must already be installed.
• With automatic updating enabled, it downloads and installs automatically.
• The standalone full-file x64 installer has SHA256 F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0. Verify this hash before deploying from a local share.

Update paths

• Microsoft 365 Apps on Windows: File > Account > Update Options > Update Now forces an update check. By default Office checks automatically, downloads in the background, and applies updates at the next opportunity, such as when Office apps close. Organizations can manage this through the Office Deployment Tool or Group Policy.
• Office for Mac: open an Office app, choose Help > Check for Updates, then Update or Update All in Microsoft AutoUpdate, and restart the app when done. Microsoft's enterprise guidance also supports distributing downloaded updates through organizational software distribution tools.

Confirming the fix is installed

• Click to Run Office (Windows): File > Account > About Excel, then compare the build with the lists above. On LTSC the build must be at or above 17932.21140 (2024) or 14334.21048 (2021).
• Mac: the Office version must be 16.115.26110837 or later.
• Office Online Server: confirm KB5002946 is installed, or that the product reports build 16.0.10417.20236.

Affected Systems and Versions

Per the MSRC advisory and NVD, the following products are affected below their fixed builds:

• Microsoft Office LTSC 2021 (Windows, 32-bit and 64-bit): NVD lists versions from 16.0.1 up to, but not including, 16.0.14334.21048.
• Microsoft Office LTSC 2024 (Windows, 32-bit and 64-bit): versions below 16.0.17932.21140.
• Microsoft 365 Apps for Enterprise (32-bit and 64-bit): builds below the per-channel November 10, 2026 builds listed above.
• Microsoft Office 365 for Mac: versions below 16.115.26110837.
• Microsoft Office LTSC for Mac 2021: versions below 16.115.26110837.
• Microsoft Office LTSC for Mac 2024: versions below 16.115.26110837.
• Office Online Server: NVD lists versions from 16.0.0.0 up to, but not including, 16.0.10417.20236.

There are two scoping pitfalls. A reviewed secondary summary characterizes only Mac builds as affected. Microsoft's advisory and NVD also list Windows products and Office Online Server, so relying on that summary would leave documented affected systems unpatched. Separately, the Office for Mac update history page shows build 16.114.4 dated November 4, 2026, which is earlier than the fixed build 16.115.26110837 named in the advisory. That history entry is not evidence that the CVE fix is installed.

Vendor Security History

The Cyber Safety Review Board's review of the 2023 Exchange Online intrusion is the most relevant independent assessment of Microsoft's historical security practices. The Board found the intrusion preventable, concluded that Microsoft's security culture was inadequate and required an overhaul, and cited avoidable errors, Microsoft's failure to detect the compromise before a customer reported anomalies, and delays in correcting inaccurate public statements.

In its July 2026 Secure Future Initiative progress report, Microsoft describes governance through a Deputy CISO structure and a centralized risk register, reports that engineering defaults prevent 83% of pipelines from accessing unapproved package endpoints, and frames its work around secure by design, secure by default, and secure in operations. These are Microsoft's own reported measures.

Neither the CSRB findings nor the SFI claims explain the technical cause of this Excel bug. The CVE-specific record is narrower and more actionable: an advisory with a concrete trigger sequence, a complete affected product list, and official fixed builds.

References

• NVD: CVE-2026-118731
• CVE Record: CVE-2026-118731
• Microsoft Security Update Guide: CVE-2026-118731
• Security update for Office Online Server: November 10, 2026 (KB5002946)
• Release notes for Microsoft Office security updates
• ZDI: The November 2026 Security Update Review
• MITRE CWE-121: Stack based Buffer Overflow
• Qualys: Microsoft Patch Tuesday, November 2026 Security Update Review
• CISA Known Exploited Vulnerabilities feed
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft Secure Future Initiative: July 2026 progress report
• Microsoft 2026 Annual Report
• Keep Office apps up to date with the latest updates
• Deploy updates for Office for Mac
• Update Microsoft 365 or Office on your macOS or iOS device
• Update history for Office for Mac
• VulDB: CVE-2026-118731
• Senserva: CVE-2026-118731