Brief Summary: CVE-2026-119986, a Microsoft Excel Heap Buffer Overflow Leading to Remote Code Execution

Introduction

Microsoft's November 10, 2026 security release fixes a heap buffer overflow in Excel that can give an attacker code execution as the signed-in user once that user opens a specially crafted file. The vulnerable parsing code ships in Microsoft 365 Apps, the Office LTSC editions, Office for Mac, and Office Online Server, so the fix has to land on desktop, Mac, and server deployments alike.

Microsoft scored CVE-2026-119986 at CVSS 3.1 8.8 (High). At publication, Microsoft listed it as not publicly disclosed and not exploited, and assessed exploitation as Less Likely. The advisory identifies no threat actor, campaign, or public proof of concept. That is a point-in-time vendor assessment, so the practical takeaway is to confirm every affected product is on a fixed build.

Technical information

Root cause

Microsoft classifies the bug as CWE 122, a heap-based buffer overflow: a write that runs past the end of a buffer allocated on the heap. Excel is closed source, and Microsoft has not published the affected code path, the file structure involved, or the specific programming error. There is no public diff or vulnerable code to examine.

What we can say is what fixes for this bug class usually look like. The parser reads a length or count from the file, and the fix adds or corrects a bounds check so that value is validated against the heap buffer that was actually allocated before any data is copied into it. Microsoft has not confirmed that this is how CVE-2026-119986 was fixed. Treat it as a description of the bug class, not of the patch.

CVSS breakdown

The vector from the MSRC entry:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• AV:N, AC:L, PR:N: the attack is scored as network-delivered, with low complexity and no privileges required on the target.
• UI:R: a user must take an action, specifically opening the crafted file.
• S:U: scope is unchanged, so code runs within the security context of the affected user.
• C:H, I:H, A:H: successful exploitation has high impact on confidentiality, integrity, and availability.
• E:U: exploit code maturity is unproven.
• RL:O: remediation level is Official Fix, meaning the complete remediation is a vendor patch.
• RC:C: report confidence is confirmed.

Attack flow

Based on Microsoft's description, exploitation proceeds as follows:

1. The attacker prepares a specially crafted file designed to trigger the heap overflow in Excel.
2. The attacker delivers the file to the target over the network. No privileges on the target system are needed.
3. The user opens the file in an affected version of Excel. Previewing it is not enough, because Microsoft states the Preview Pane is not an attack vector.
4. Processing the file overflows a heap buffer, and successful exploitation results in code execution in the context of the signed-in user.

Because scope is unchanged, the resulting code runs with that user's privileges. Systems where users routinely open files from untrusted sources are the natural place to prioritize.

Patch information

Microsoft fixed CVE-2026-119986 in its November 10, 2026 security release. The fix ships only as updated Office binaries. There is no workaround, and changing Preview Pane settings does not address the documented attack path. To confirm protection, verify that each product is at or above its fixed build.

Fixed builds

From the MSRC Security Update Guide, all released November 10, 2026:

• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): the fixed build varies by update channel, so compare against the matching entry at aka.ms/OfficeSecurityReleases. Delivered through the Click to Run channel update.
• Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140, delivered through Click to Run.
• Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048, delivered through Click to Run.
• Office 365 for Mac, Office LTSC for Mac 2021, Office LTSC for Mac 2024: 16.115.26110837, delivered through Microsoft AutoUpdate.
• Office Online Server: 16.0.10417.20236, delivered as KB5002946.

The fix is in the Excel parsing code shipped by every product above, including the server-side Excel rendering in Office Online Server.

Office Online Server: KB5002946

Office Online Server is the only affected product with its own KB package:

• Cumulative Excel update: KB5002946 lists CVE-2026-119986 alongside dozens of other Excel remote code execution and information disclosure CVEs fixed in the same release. Installing it closes all of them together.
• Build: 16.0.10417.20236. The release version of Office Online Server must already be installed.
• Replaces: the earlier security update KB5002928.
• Distribution: Microsoft Update (installs automatically when automatic updating is enabled), the Microsoft Update Catalog (search for KB5002946), or the Microsoft Download Center.
• Integrity check: Microsoft publishes the SHA256 of the standalone x64 full-file installer. Verify it before deploying, particularly if the file passes through internal distribution points. Microsoft also publishes a CSV listing the files changed by the update.

SHA256: F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0

Click to Run and Mac clients

Microsoft 365 Apps and the LTSC editions do not use a separate KB. The fix arrives through the normal Click to Run update channel, and on Mac through Microsoft AutoUpdate. To confirm, open Excel and check File > Account > About Excel, then compare the installed version against the fixed build above. For Microsoft 365 Apps, use the build for your specific update channel.

Rapid7's vulnerability database gives the same remediation: update Microsoft Office to the latest version, and install KB5002946 on Office Online Server.

Affected systems and versions

NVD's affected-version data, supplied by Microsoft as the CNA, matches the fixed build list. Every build below the fixed number is vulnerable.

• Microsoft 365 Apps for Enterprise, 32-bit and 64-bit systems: builds below the fixed build for the relevant update channel.
• Microsoft Office LTSC 2024, 32-bit and 64-bit editions: builds below 16.0.17932.21140.
• Microsoft Office LTSC 2021, 32-bit and 64-bit editions: builds below 16.0.14334.21048.
• Office for Mac (Microsoft Office 365 for Mac, Office LTSC for Mac 2024, Office LTSC for Mac 2021): builds below 16.115.26110837.
• Office Online Server: from 16.0.0.0 up to, but not including, 16.0.10417.20236.

The documented attack requires a user to open a crafted file in one of these products. The Preview Pane is not an attack vector.

References

• Microsoft Security Update Guide: CVE-2026-119986
• NVD: CVE-2026-119986
• CVE Record: CVE-2026-119986
• Microsoft Support: Security update for Office Online Server, November 10, 2026 (KB5002946)
• Rapid7 Vulnerability Database: CVE-2026-119986
• Microsoft 365 Apps security release builds by channel
• Microsoft Learn: Release notes for Microsoft Office security updates
• MITRE CWE 122: Heap based Buffer Overflow
• CISA Known Exploited Vulnerabilities Catalog
• Threat Radar: CVE-2026-119986
• Microsoft Investor Relations: FY25 Q4 Productivity and Business Processes Performance