Overview of CVE-2026-120786: Heap-Based Buffer Overflow in Microsoft Excel Enabling Code Execution

Introduction

A heap-based buffer overflow in Microsoft Excel, fixed in Microsoft's November 10, 2026 Patch Tuesday release, can let an attacker execute code as the signed-in user once that user opens a crafted workbook and interacts with affected workbook features. The affected list spans Microsoft 365 Apps, Office LTSC on Windows and Mac, Office 365 for Mac, and Office Online Server, so remediating CVE-2026-120786 means knowing which update path each deployment uses.

Microsoft, acting as CNA, supplies a CVSS 3.1 base score of 8.8, which NVD classifies as HIGH. The MSRC advisory separately assigns a maximum severity rating of Critical. These are two different rating systems, and we keep both when communicating priority. At publication, Microsoft reports Exploited: No and Publicly disclosed: No, and assesses the issue as Exploitation Less Likely.

Technical information

Root cause

Microsoft classifies the issue as CWE 122, Heap based Buffer Overflow. MITRE defines this weakness as writing past the end of a buffer allocated on the heap. That tells us the memory-safety class of the bug. It does not tell us which Excel routine, workbook structure, or programming mistake is responsible.

Excel and Office Online Server are closed source. Microsoft has published no source diff, commit, or root cause write-up. The advisory also does not disclose:

• the vulnerable function
• the specific workbook feature involved
• a malicious workbook sample
• a reproducible exploit

In file parsers, a heap overflow typically comes from a length or count read from the file being trusted without checking it against the size of the heap buffer it is copied into. This is a general pattern for the bug class, not a confirmed root cause for this CVE. Conceptually, the November builds change how Excel handles the affected workbook structures so that a malformed file no longer writes past its heap allocation. Microsoft has not said which record type or function was changed, so the exact check that was added cannot be confirmed from public sources.

CVSS scoring

The Microsoft CNA base vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

• Attack Vector: Network. The attack can originate remotely.
• Attack Complexity: Low. No specialized conditions are needed beyond the scored prerequisites.
• Privileges Required: None. The attacker needs no prior privileges.
• User Interaction: Required. A user must take part in exploitation.
• Scope: Unchanged. The impact stays within the same security authority.
• Confidentiality, Integrity, Availability: High.

The Network vector does not cancel the separate user-interaction requirement. Microsoft also publishes a temporal score of 7.7, with E:U/RL:O/RC:C:

• E:U (Unproven): no publicly available exploit code, or only a theoretical exploit.
• RL:O (Official Fix): a complete vendor fix is available.

When reporting severity, use the 8.8 base score. The temporal score does not replace it. NVD lists the 8.8 score as supplied by the Microsoft CNA and shows enrichment as in progress, so there is no independent NIST base assessment yet.

Attack flow

Based on Microsoft's documented scenario:

1. The attacker prepares a specially crafted Excel workbook.
2. The attacker convinces a user to open the workbook in Microsoft Excel.
3. The user interacts with affected workbook features. Microsoft does not say which feature, so a specific action, such as entering a formula, cannot be asserted.
4. The crafted content triggers a write past the end of a heap allocation.
5. If exploitation succeeds, the attacker can execute code in the context of the signed-in user.

The advisory sets two limits on that scenario:

• Microsoft explicitly says the Preview Pane is not an attack vector. Previewing the file alone is not the documented trigger.
• The documented outcome is code execution as the signed-in user. Nothing in the advisory supports a claim of automatic administrator or SYSTEM-level access.

Exploitation status

• Microsoft's advisory: Exploited: No, Publicly disclosed: No, Exploitation Less Likely, exploit maturity Unproven.
• OffSeq Threat Radar: no recorded exploitation in the wild, no CISA KEV listing, and no public exploit code indexed in Metasploit or Exploit-DB.
• CISA: the November 10, 2026 announcement added six other vulnerabilities to the KEV catalog and did not include this identifier. That announcement alone is not a full catalog status check.
• Credit: Microsoft credits an anonymous contributor. A researcher credit is not attribution to an attacker.

The reviewed materials identify no campaign, actor, file hashes of malicious samples, infrastructure indicators, or detection signatures for this CVE.

Patch information

Microsoft fixed CVE-2026-120786 in its November 10, 2026 Patch Tuesday release, and the MSRC advisory sets the CVSS Remediation Level to Official Fix. With no source fix to inspect, verification comes down to build numbers and update packages.

Fixed builds by product

The MSRC Security Updates table and the matching NVD and CNA version ranges list these builds as the first fixed versions. Any earlier build is affected.

• Office Online Server: 16.0.10417.20236, delivered through KB5002946 (Microsoft Update, Update Catalog, Download Center).
• Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140, delivered through a Click to Run channel update.
• Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048, delivered through a Click to Run channel update.
• Microsoft Office LTSC for Mac 2024, LTSC for Mac 2021, and Office 365 for Mac: 16.115.26110837, delivered through the Office for Mac release and Microsoft AutoUpdate.
• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): the fixed build depends on the update channel. See Microsoft's Office security release page.

Microsoft 365 Apps has no single fixed build. Each channel, including Current, Monthly Enterprise, and Semi Annual, receives its own patched build. As one example, Microsoft's November 10 release notes list Current Channel Version 2610, Build 20527.20196. Check the entry for your own channel rather than applying that build everywhere.

Office Online Server package (KB5002946)

KB5002946 lists CVE-2026-120786 among the Excel remote code execution and information disclosure CVEs it fixes. The same package also covers CVE-2026-120785, CVE-2026-120788, CVE-2026-120789, CVE-2026-120790, and CVE-2026-120791.

• Package build: 16.0.10417.20236
• Prerequisite: the release version of Office Online Server must already be installed.
• Supersedes: KB5002928. Servers on that update or older are still exposed.
• Installer: wacserver2019-kb5002946-fullfile-x64-glb.exe
• SHA256: F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0
• Availability: automatically through Microsoft Update, as a standalone package from the Microsoft Update Catalog (search KB5002946), or from the Download Center (download ID 108899).
• File list: Microsoft publishes a CSV (5002946.csv) listing the binaries the update replaces. Comparing those files before and after patching is the only practical way to locate the changed Excel parsing code.

Microsoft's deployment guidance warns that automatic updating is not supported for Office Online Server and can disrupt document viewing or editing.

For a single-server farm, Microsoft documents this sequence:

1. Record the farm settings.
2. Remove the server from the farm.
3. Install the update, restarting if prompted.
4. Recreate the farm with the same settings.

The farm is unavailable while this runs. For farms with multiple servers, Microsoft documents updating servers in stages and moving them into the updated farm.

Desktop and Mac update mechanics

• Windows: open any Office app and select File > Account > Update Options > Update Now. If needed, select Enable Updates first. If Update Options is missing, volume licensing or Group Policy may control updates, and Microsoft directs users to Microsoft Update or their help desk.
• Mac: use Microsoft AutoUpdate or centralized software distribution. Security fixes are delivered inside updated application bundles, not as separately installable fixes.

Verifying the fix

A host is patched when its product build is equal to or higher than the fixed build listed above. On Office Online Server, also confirm that KB5002946, or a later update that supersedes it, shows as installed.

The advisory does not provide a workaround specific to this vulnerability. Microsoft's general Protected View guidance is to stay in read-only mode when editing is not needed, enable editing only for trusted sources and content, and close and delete suspicious files. That guidance is sensible handling practice, but it is not a confirmed mitigation for this CVE.

Affected systems and versions

The CVE record published by the Microsoft CNA lists these affected ranges:

• Microsoft 365 Apps for Enterprise (32 bit and x64): from 16.0.1. The upper boundary points to Microsoft's release information, and the fix depends on the update channel.
• Microsoft Office LTSC 2021 (32 bit and x64): from 16.0.1, before 16.0.14334.21048.
• Microsoft Office LTSC 2024 (32 bit and x64): from 16.0.0, before 16.0.17932.21140.
• Microsoft Office 365 for Mac: from 1.0.0, before 16.115.26110837.
• Microsoft Office LTSC for Mac 2021: from 16.0.1, before 16.115.26110837.
• Microsoft Office LTSC for Mac 2024: from 16.0.0, before 16.115.26110837.
• Office Online Server: from 16.0.0.0, before 16.0.10417.20236 (KB5002946).

One desktop update does not cover every listed product family. Windows desktop, Mac, and Office Online Server each need their own correction path.

Vendor security history

The Cyber Safety Review Board concluded that the 2023 Exchange Online intrusion was preventable and was enabled by a cascade of Microsoft security failures. The Board's findings included:

• Microsoft's security culture was inadequate.
• Microsoft did not independently detect the compromise of important cryptographic assets. A customer identified the anomalies instead.
• Microsoft was slow to correct inaccurate public statements.

DHS attributed that intrusion to Storm 0558, assessed as affiliated with the People's Republic of China. This is background on Microsoft's track record only. It is not attribution for CVE-2026-120786.

Microsoft launched its Secure Future Initiative in November 2023 and expanded it to six security pillars in May 2024. The September 2024 progress report describes a Cybersecurity Governance Council, Deputy CISOs, and security performance tied to senior leadership compensation. In its July 2026 report, Microsoft says:

• phishing-resistant MFA is enforced at 99.97% user and device coverage
• 93% of critical and high-value build pipelines use centrally governed templates

These are organization-level, self-reported figures. They do not indicate whether any given Excel installation is patched.

On market position, the European Commission's Teams decision records a preliminary finding of Microsoft dominance in worldwide SaaS productivity applications for professional use. A UK CMA investigation notice dated May 14, 2026 cites significant Microsoft market power in productivity software. Both help explain why most organizations manage Excel exposure inside the Microsoft ecosystem rather than by switching products.

References

• NVD entry for CVE-2026-120786
• CVE.org record for CVE-2026-120786
• Microsoft Security Update Guide: CVE-2026-120786
• KB5002946: Security update for Office Online Server, November 10, 2026
• Release notes for Microsoft Office security updates
• Apply software updates to Office Online Server
• How to update Microsoft 365 or Office for Windows
• Deploy updates for Office for Mac
• What is Protected View?
• MITRE CWE 122: Heap based Buffer Overflow
• OffSeq Threat Radar entry for CVE-2026-120786
• CISA adds six Known Exploited Vulnerabilities to catalog (November 10, 2026)
• CrowdStrike: November 2026 Patch Tuesday analysis
• Cisco Talos: Microsoft Patch Tuesday for November 2026
• Zero Day Initiative: The November 2026 Security Update Review
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• DHS: CSRB releases report on Microsoft Exchange Online incident
• Microsoft SFI Progress Report, July 2026
• Microsoft SFI progress update, September 2024
• European Commission Teams decision (EUR Lex)
• UK CMA Investigation Notice