Introduction
A crafted spreadsheet that runs code when a user opens it remains one of the most practical initial access paths into enterprise environments, and CVE-2026-118732 is a new instance of that pattern in Microsoft Office Excel. Microsoft fixed this use after free on November 10, 2026, across Windows Click to Run channels, Office LTSC 2021 and 2024, Office for Mac, and Office Online Server, so most organizations running Office will have at least one deployment whose build number needs checking.
Technical information
Root cause
The weakness is classified as CWE 416, use after free: software references memory after that memory has been freed. Microsoft's description is short: "Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network." Microsoft has not published source code, a diff, or a technical root cause writeup, and the public record does not identify the vulnerable code path or the specific memory object involved. All that exists publicly is a set of compiled updates.
What we can say is how this class of bug typically manifests in Excel. An object is freed while Excel is parsing a specially crafted workbook, but a pointer to that object is retained and dereferenced later. If an attacker can influence what occupies the freed memory before the stale pointer is used, the result can be control over execution. Fixes for this class usually tighten object ownership and lifetime, for example through reference counting, clearing the pointer after it is freed, or checking the object's state before use. Microsoft has not said which approach it took here.
MSRC itself provides one useful clue. The attack requires the user to open a malicious file, and the Preview Pane is explicitly not an attack vector. That points to the fix living in Excel's file loading or processing code rather than in the preview handler.
Scoring
- CVSS 3.1 base score: 8.8 (High)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Microsoft severity: Important
- Remediation level: Official Fix
- Exploitability assessment: Exploitation Less Likely
- Credit: Haein Lee of KAIST Hacking Lab
The combination of AV:N and UI:R in the vector should not be read as "an attacker can reach Excel over the network directly." The trigger Microsoft describes is a victim opening a file. The network rating reflects that the malicious file can be delivered remotely.
Attack flow
Based on Microsoft's advisory, exploitation proceeds as follows:
- The attacker prepares a specially crafted Excel file designed to trigger the use after free during file loading or processing.
- The attacker delivers the file to the target. No privileges on the target system are required (
PR:N). Microsoft does not specify a particular delivery channel. - The victim opens the file in Excel. Previewing it in the Preview Pane does not trigger the bug, according to MSRC.
- While processing the workbook, Excel frees an object but later references it through a stale pointer, which the attacker uses to achieve code execution. Microsoft rates confidentiality, integrity, and availability impact as High.
Exploitation status
At publication, Microsoft listed the vulnerability as not publicly disclosed and not exploited, and assessed exploitation as Less Likely. The Senserva tracker likewise reported no observed exploitation as of November 10, 2026, no listing in the CISA Known Exploited Vulnerabilities catalog at that time, and no known ransomware use. We found no named threat actor or public exploit in the reviewed sources. Treat this as the status at that point in time, not as a guarantee.
Patch information
Microsoft released fixes on November 10, 2026 (Patch Tuesday). Because this is a closed-source binary fix, the practical way to confirm protection is to check the build number. Any build below the following is vulnerable:
- Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048 (Version 2108)
- Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140 (Version 2408)
- Microsoft Office 365 for Mac, Office LTSC for Mac 2021 and 2024: 16.115.26110837
- Office Online Server: 16.0.10417.20236 (KB5002946)
- Microsoft 365 Apps for Enterprise (32 bit and 64 bit): channel specific; MSRC links to the Office Security Releases page
Click to Run channel builds
Microsoft's November 10 Office security release notes list CVE-2026-118732 under Excel, with these builds:
- Current Channel: Version 2610, Build 20527.20196
- Monthly Enterprise Channel: 2610 (20527.20194), 2609 (20430.20264) or 2608 (20326.20320)
- Semi Annual Enterprise Channel: 2610 (20527.20192), 2609 (20430.20262) or 2608 (20326.20318)
- Office 2021 and 2024 Retail: 2610 (20527.20196)
On Windows, Click to Run installs (Microsoft 365 Apps and LTSC) receive the fix through the normal Office update channel. Mac installs receive it through Microsoft AutoUpdate, as described in the Office for Mac release notes.
Office Online Server (KB5002946)
Office Online Server is the one product where the fix is a separately installed package. KB5002946 is a single security update that addresses CVE-2026-118732 along with about 55 other Excel CVEs released the same day. Details:
- Build: 16.0.10417.20236
- Supersedes: KB5002928 (the October update)
- Prerequisite: the release version of Office Online Server must already be installed
- Distribution: Microsoft Update; the Microsoft Update Catalog (search
KB5002946); the Download Center (download ID 108899) - File:
wacserver2019-kb5002946-fullfile-x64-glb.exe - SHA256:
F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0
Check the hash before you deploy. Microsoft also publishes a CSV listing every file KB5002946 updates, which is useful if you want to compare file versions or diff binaries yourself.
Verifying the patch
- Windows: in Excel, go to File, Account, About Excel and check the build.
- Mac: go to Excel, About Excel and check the version.
- Office Online Server: confirm the installed version is 16.0.10417.20236 or later.
Compare the result against the builds above. Until updates are applied, avoiding unexpected or untrusted Excel files reduces exposure, since opening the file is the stated prerequisite. It is not a substitute for the vendor fix.
Affected systems and versions
The CVE record and NVD list the following affected ranges. "Before" means the listed fixed build itself is not affected.
- Microsoft 365 Apps for Enterprise: from 16.0.1; the record points to Microsoft's Office Security Releases page for the upper boundary rather than a single fixed version.
- Microsoft Office 365 for Mac: from 1.0.0 before 16.115.26110837.
- Microsoft Office LTSC 2021: from 16.0.1 before 16.0.14334.21048.
- Microsoft Office LTSC 2024: from 16.0.0 before 16.0.17932.21140.
- Microsoft Office LTSC for Mac 2021: from 16.0.1 before 16.115.26110837.
- Microsoft Office LTSC for Mac 2024: from 16.0.0 before 16.115.26110837.
- Office Online Server: from 16.0.0.0 before 16.0.10417.20236.
At the time of review, NVD marked its record as undergoing enrichment.
Vendor security history
BeyondTrust's 2026 Microsoft Vulnerabilities Report states that Microsoft Office had 157 vulnerabilities in 2025, more than three times the total recorded in 2024, and that critical vulnerabilities increased tenfold year over year. This is a count of reported vulnerabilities, not a measure of exploitability, and it does not explain the cause of this specific CVE. The scale of the November 10 release is consistent with that trend: KB5002946 alone covers about 55 other Excel CVEs alongside CVE-2026-118732.
References
- Microsoft Security Response Center advisory for CVE-2026-118732
- NIST NVD record for CVE-2026-118732
- CVE Program record for CVE-2026-118732
- Microsoft Support: Security update for Office Online Server, KB5002946
- Microsoft Download Center: KB5002946
- Microsoft 365 Apps security update release notes
- Microsoft Office Security Releases
- BeyondTrust 2026 Microsoft Vulnerabilities Report
- Senserva CVE tracker entry (secondary patch and threat status context)
- CVEfeed entry
- VulDB entry
