Overview of CVE-2026-120785: Heap-Based Buffer Overflow Leading to Code Execution in Microsoft Excel

Introduction

A heap-based buffer overflow in Microsoft Office Excel, fixed in Microsoft's November 10, 2026 Patch Tuesday release, gives an attacker a route to code execution on any machine where a user opens a crafted workbook and interacts with the affected features. The Excel engine ships in Microsoft 365 Apps, Office LTSC on Windows and Mac, and Office Online Server, so no single package closes the hole everywhere. That is where most of the operational work lies.

The NVD feed listed the vendor as Unknown, but the MSRC advisory identifies Microsoft as both the assigning CNA and the affected vendor. Microsoft scores the issue at CVSS 3.1 base 8.8 (High) and rates its maximum severity as Important. These are separate rating systems, and both point to the same action: apply the applicable Microsoft update.

Technical information

Root cause

The assigned weakness is CWE 122, Heap based Buffer Overflow. MITRE defines this class as writing beyond the end of a buffer allocated on the heap. General consequences of the class include crashes and, in some cases, overwriting function pointers to redirect execution. Those describe the weakness class in general. Microsoft has not disclosed any of them as implementation details of this Excel bug.

Excel is closed source, and Microsoft has not published a diff, commit, or root-cause write-up beyond the CWE category. The public advisory does not identify:

• the affected workbook feature
• the parser function or faulty code location
• the specific file format variant
• any memory offset or layout detail
• whether macros play any role

Because of that, no payload structure or reproducible exploitation procedure is publicly established, and we are not going to speculate about one. Microsoft's FAQ does support one inference. Exploitation requires interacting with the affected workbook features after opening the file, so the bug sits in the code path Excel uses when parsing and handling those features.

Reading the CVSS vector correctly

Microsoft publishes a base score of 8.8 and a temporal score of 7.7 with the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• AV:N (Network): the attack is classified as network deliverable.
• AC:L (Low): low attack complexity under the scoring model.
• PR:N (None): the attacker needs no prior privileges.
• UI:R (Required): a user must take action before exploitation succeeds.
• S:U (Unchanged): impact stays within the same security authority.
• C:H / I:H / A:H: high potential confidentiality, integrity, and availability impact.
• E:U (Unproven): exploit maturity is unproven.
• RL:O (Official Fix): a complete vendor solution is available, which is why the temporal score drops to 7.7.
• RC:C (Confirmed): the vulnerability's validity is confirmed. This does not mean exploitation in the wild is confirmed.

No attacker privileges are required, but user interaction is. The network vector and the high impact ratings do not override that prerequisite. Read the description's phrase "unauthorized attacker to execute code over a network" together with UI:R and Microsoft's FAQ.

Attack flow

Based on Microsoft's documented scenario, exploitation looks like this:

1. The attacker builds a specially crafted Excel workbook containing malformed data aimed at the vulnerable handling of an affected workbook feature. Microsoft has not disclosed which feature.
2. The attacker gets the file to a target and convinces the user to open it in Excel. The advisory does not specify a delivery method such as email, a malicious website, or a network service endpoint.
3. The user opens the workbook and interacts with the affected workbook features. Merely receiving the file is not documented as sufficient, and Microsoft explicitly states that the Preview Pane is not an attack vector.
4. Attacker-controlled values in the file cause Excel to write past the end of a heap allocation.
5. On successful exploitation, attacker code runs in the context of the signed-in user. The published impact does not establish automatic administrator or SYSTEM access.

The attack depends on user interaction. Nothing documents it as a zero-click exploit.

Exploitation status at publication

Microsoft's exploitability assessment at original publication records Publicly disclosed: No, Exploited: No, and Exploitation Unlikely. OffSeq's Threat Radar, dated November 10, 2026, reports no indexed Metasploit or Exploit DB module, no public Nuclei template, no CISA KEV listing, and no attack traffic observed by its Mirage sensors, while noting that missing evidence is not evidence of safety. No threat actor, campaign, victim, file hash, or command and control indicator has been tied to this CVE. The defensible reading is "not known to be exploited," which is a much weaker claim than "incapable of exploitation."

Patch information

Microsoft fixed CVE-2026-120785 in its November 10, 2026 Patch Tuesday release. The MSRC advisory sets the CVSS temporal Remediation Level to Official Fix, defined as "a complete vendor solution is available." Because Excel is closed source, the fix ships only as updated binaries, and the reliable way to confirm remediation is to check that each install is at or above the fixed build.

How the fix is delivered

The patch lands in Excel's file-parsing code, so every product that includes the Excel engine receives a new build. That covers desktop Office on Windows and Mac, and also Office Online Server, which renders workbooks on the server side.

• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): fixed build is per channel, listed at Office Security Releases, and delivered as a Click to Run channel update.
• Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140, delivered as a Click to Run security update.
• Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048, delivered as a Click to Run security update.
• Office 365 for Mac, Office LTSC for Mac 2021 and 2024: 16.115.26110837, delivered via Microsoft AutoUpdate and the Office for Mac release (Version 16.115 (26110837) in the Mac update history, dated November 10, 2026).
• Office Online Server: 16.0.10417.20236, delivered as KB5002946.

Office Online Server: KB5002946

This is the only fix with its own standalone KB.

• It is a cumulative package covering many CVEs. Microsoft describes it as resolving Excel remote code execution and information disclosure vulnerabilities, and CVE-2026-120785 appears alongside related Excel bugs including CVE-2026-120786, CVE-2026-120788, CVE-2026-120789, CVE-2026-120790, and CVE-2026-120791.
• It replaces the earlier security update KB5002928. Because it is cumulative, it can be installed directly without first applying KB5002928.
• It requires the release version of Office Online Server to already be installed.
• It is available through Microsoft Update (installed automatically when automatic updating is enabled), the Microsoft Update Catalog, and the Microsoft Download Center.
• Microsoft also publishes a CSV listing the files in the update.

To confirm the standalone download has not been tampered with, verify the package hash:

File:   wacserver2019-kb5002946-fullfile-x64-glb.exe
SHA256: F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0

The server KB does not replace the desktop version boundaries. Use KB5002946 for Office Online Server and the appropriate Office release for desktop installations.

What the fix changes

Microsoft has not explained the root cause beyond the CWE category. In general, a heap overflow fix in a file parser like Excel's adds bounds or length checks, or corrects a size calculation, so that values from an attacker-controlled file can no longer write past the end of a heap allocation. Given the FAQ's requirement to interact with affected workbook features, the change most likely lives in the code that parses those features. No public diff confirms the exact routine, and none of the sources describe the fix in detail.

Microsoft did not publish a CVE-specific workaround. Macro blocking, registry changes, and Preview Pane settings are not documented as alternative fixes, and the Preview Pane is outside the documented attack vector anyway. Installing the fixed release is the only corrective action supported by vendor information.

Verifying the patch

• Windows Click to Run Office: check the version under File > Account > About Excel against the builds above. For Microsoft 365 Apps, compare against your update channel's November 2026 build.
• Mac: confirm Excel reports 16.115.26110837 or later.
• Office Online Server: confirm KB5002946 is installed, or that the product build is 16.0.10417.20236 or later.

The flaw was reported through coordinated disclosure, and Microsoft credits researcher Jeongmin Choi.

Affected systems and versions

NVD's affected product data, supplied by Microsoft as the CNA, uses the fixed builds as the upper bounds of the vulnerable ranges. Any version below the listed build is vulnerable.

• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): channel dependent. The CVE record points to Office Security Releases rather than one numeric fixed version. Builds earlier than your channel's November 10, 2026 security build are affected.
• Microsoft Office LTSC 2024 (32 bit and 64 bit): versions below 16.0.17932.21140.
• Microsoft Office LTSC 2021 (32 bit and 64 bit): versions below 16.0.14334.21048.
• Microsoft Office 365 for Mac: versions below 16.115.26110837.
• Microsoft Office LTSC for Mac 2021: versions below 16.115.26110837.
• Microsoft Office LTSC for Mac 2024: versions below 16.115.26110837.
• Office Online Server: from 16.0.0.0 up to, but not including, 16.0.10417.20236.

The vulnerable configuration documented by Microsoft is a user opening a crafted workbook in an affected Excel build and interacting with the affected workbook features. Previewing a file in the Preview Pane is not an attack vector. The affected scope covers Windows, Mac, and server products, so treating this as a single-platform bug would leave installs exposed.

Vendor security history

Microsoft's broader security record provides context, not attribution, for this bug. The Cyber Safety Review Board's review of the 2023 Exchange Online intrusion concluded that the intrusion was preventable, identified a cascade of avoidable errors including failure to independently detect compromise of critical cryptographic material, and found Microsoft's security culture inadequate and in need of an overhaul. The Board recommended direct CEO and board attention, a public reform plan with specific timelines, and accountability for senior officers.

Microsoft's April 2025 Secure Future Initiative progress report describes a revised governance structure, Deputy CISO responsibility covering Microsoft 365 and related businesses, risk inventories, and a Security Core Priority tied to employee performance reviews, while acknowledging more work remains. These are vendor-reported reforms, not independent proof that the underlying problems are resolved.

None of this connects the Exchange incident, its actor, or its mechanism to CVE-2026-120785. For this Excel bug, Microsoft has published an actionable, product-specific remediation path, and applying it is what matters.

References

• MSRC Security Update Guide: CVE-2026-120785
• NVD: CVE-2026-120785
• CVE Record: CVE-2026-120785
• Security update for Office Online Server: November 10, 2026 (KB5002946)
• Microsoft Download Center: KB5002946
• Release notes for Microsoft Office security updates (Office Security Releases)
• Release notes for Microsoft 365 Apps security updates
• Update history for Office for Mac
• Release notes for Office for Mac
• MITRE CWE 122: Heap based Buffer Overflow
• OffSeq Threat Radar: CVE-2026-120785
• Senserva: CVE-2026-120785 Office Online Server fix KB5002946
• Qualys: Microsoft Patch Tuesday, November 2026 Security Update Review
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft Secure Future Initiative: April 2025 progress report
• Microsoft 2026 Annual Report