Quick Look: Microsoft Excel CVE-2026-120789 Heap-Based Buffer Overflow Leading to Remote Code Execution

Introduction

A heap-based buffer overflow in Microsoft Office Excel, fixed in Microsoft's November 10, 2026 Patch Tuesday release, can let an attacker run code as the signed-in user once that user opens and works with a crafted workbook. The fix spans Click to Run clients, LTSC editions, Mac builds, and Office Online Server, so remediating CVE-2026-120789 is mostly a matter of matching each deployment to its correct update rather than applying a single package.

NVD scores the issue 8.8 (High) under CVSS 3.1, while Microsoft assigns a maximum severity of Critical. The two come from different rating systems, so they do not conflict. At publication, Microsoft reported the vulnerability as not exploited and not publicly disclosed, with an assessment of Exploitation Less Likely.

Technical information

Root cause: CWE-122 in Excel

Microsoft and NVD classify the flaw as CWE-122: Heap based Buffer Overflow. MITRE defines this weakness class as a buffer overflow in which the overwritten buffer lives in heap memory, typically allocated through a routine such as malloc(). General consequences of the class include memory corruption and arbitrary code execution, for example through corrupted function pointers that the program later uses.

Much of the detail is not public. Excel is closed source, there is no public commit or diff, and Microsoft's advisory does not disclose:

• the vulnerable function or parser
• the workbook record type or structure that triggers the overflow
• the allocation size calculation or overwrite layout
• whether macros need to be enabled
• a specific workbook file extension
• a working exploit

With this bug class, a fix is commonly a bounds or length check added before data parsed from the file is copied into a heap buffer. That is an inference from the CWE, not something Microsoft has confirmed for this CVE. We deliberately avoid filling the gaps with generic heap exploitation techniques or details borrowed from other Office CVEs.

Attack flow

Based on Microsoft's advisory FAQ, the documented exploitation sequence is:

1. An unauthorized attacker prepares a specially crafted Excel workbook.
2. The attacker delivers the workbook to a target and convinces the user to open it.
3. The user opens the workbook in a vulnerable Excel build and interacts with affected workbook features (Microsoft does not name which features).
4. The crafted content triggers the heap overflow in the code that runs when the workbook is opened and used.
5. Successful exploitation executes code in the context of the signed-in user, inheriting that user's access rather than automatically gaining administrative privileges.

Microsoft explicitly states that the Preview Pane is not an attack vector. Previewing a file is not enough. The workbook must be opened and used.

Reading the CVSS vector

The published CVSS 3.1 base vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector: Network. This reflects remote delivery of the file. It does not mean an exposed network service that executes code without anyone opening a workbook.
• Attack Complexity: Low.
• Privileges Required: None. The attacker needs no prior access.
• User Interaction: Required. A user must open and interact with the workbook.
• Scope: Unchanged.
• Confidentiality, Integrity, Availability: High.

Microsoft's temporal score is 7.7, incorporating exploit code maturity of Unproven, remediation level of Official Fix, and report confidence of Confirmed.

Exploitation status

• Microsoft: not exploited, not publicly disclosed, and assessed as Exploitation Less Likely, all as of original publication. The advisory itself is now public, so read the disclosure flag in that publication context.
• OffSeq Threat Radar (data as of 18:50 UTC, November 10, 2026): no indexed public exploit in Metasploit or Exploit DB, and no observed attack traffic in its Mirage sensors. This finding is limited to the provider's stated coverage.
• Attribution: no threat actor, campaign, or CVE-specific indicators of compromise are identified in the reviewed reporting.
• Related CVEs: the Security Risk Advisors November bulletin lists this CVE among the critical items, but its active exploitation note refers to CVE-2026-124194, not this Excel flaw. Exploitation of another CVE in the same release is not evidence about this one.
• CISA KEV: the reviewed catalog page offered only a partial view, so we draw no conclusion about membership.

These are dated assessments. They do not guarantee the absence of later exploitation, and Exploitation Less Likely is not a reason to discount the documented impact.

Patch information

Microsoft fixed CVE-2026-120789 in its November 10, 2026 Patch Tuesday release, and the MSRC advisory sets the temporal Remediation Level to Official Fix, meaning a complete vendor fix is available. All fix information here comes from Microsoft's advisory, the NVD record, and the Office Online Server KB article. Because the Preview Pane is not an attack vector, the update addresses the code that runs when a workbook is opened and used, not the file previewer.

Fixed builds by product

Any build below these is vulnerable:

• Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140
• Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048
• Microsoft Office 365 for Mac, Office LTSC for Mac 2024 and 2021: 16.115.26110837
• Office Online Server: 16.0.10417.20236 (KB5002946)
• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): build depends on update channel (see Office Security Releases)

Office Online Server: KB5002946

Office Online Server runs Excel's rendering engine on the server, so it receives its own package. KB5002946 (build 16.0.10417.20236) lists CVE-2026-120789 among many Excel CVEs fixed in one cumulative update.

• It replaces the October 2026 update, KB5002928. Because it is cumulative, installing it also brings in earlier Excel fixes for Office Online Server.
• The release version of Office Online Server must already be installed before applying it.
• It is available through Microsoft Update, the Microsoft Update Catalog (search for KB5002946), and the Microsoft Download Center (download ID 108899).
• Microsoft also publishes a CSV listing every file the update changes.

The standalone installer and its Microsoft-published SHA256 hash are below. Verify the hash before deploying offline:

wacserver2019-kb5002946-fullfile-x64-glb.exe
SHA256: F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0

Click to Run, LTSC, and Mac clients

Microsoft 365 Apps and the Office LTSC editions receive the fix through the normal Office update channels, and the advisory points to the Microsoft 365 Apps security release notes. Mac editions receive it through the standard Office for Mac update, version 16.115.26110837. To confirm a client is patched, check that its Office version (File > Account > About) is at or above the build listed above.

A note on unrelated KBs

Some third-party roundups tied this CVE to Windows cumulative updates such as KB5131096. This is an Office and Excel vulnerability, and the advisory lists only Office products, so Windows OS updates do not fix it.

The advisory documents no specific workaround. General CWE guidance such as bounds checking and memory layout randomization is developer guidance or defense in depth, not a substitute for the update.

Affected systems and versions

The CNA record (reproduced by NVD) lists seven product families. The upper values are exclusive bounds of the affected ranges:

• Microsoft 365 Apps for Enterprise: from 16.0.1 up to the referenced Office security release for the installed channel
• Microsoft Office 365 for Mac: from 1.0.0, below 16.115.26110837
• Microsoft Office LTSC 2021: from 16.0.1, below 16.0.14334.21048
• Microsoft Office LTSC 2024: from 16.0.0, below 16.0.17932.21140
• Microsoft Office LTSC for Mac 2021: from 16.0.1, below 16.115.26110837
• Microsoft Office LTSC for Mac 2024: from 16.0.0, below 16.115.26110837
• Office Online Server: from 16.0.0.0, below 16.0.10417.20236

The vulnerable configuration is any of these builds in which a user opens and interacts with a crafted workbook. A Windows LTSC build number, a Mac release, and an Office Online Server package are not interchangeable. LTSC 2021 and LTSC 2024 use different fixed builds, and Microsoft 365 Apps has no single numeric fixed version in the CNA entry.

Vendor security history

The vendor field in the raw CVE data was listed as Unknown, but NVD identifies Microsoft Corporation as the source and Microsoft is the assigning CNA. Microsoft describes Microsoft 365 Commercial as a productivity platform combining Office, Windows, Microsoft 365 Copilot, and Enterprise Mobility + Security, which gives Excel broad enterprise relevance. A 2025 Bloomberg feature described competitors, including Google, as not having mounted a serious challenge to Excel. That is qualitative context, not a measured market-share figure.

On track record, the Cyber Safety Review Board found the summer 2023 Exchange Online intrusion preventable. DHS summarized a series of operational and strategic decisions that pointed to a culture deprioritizing enterprise security investments and rigorous risk management, and the Board recommended Microsoft publish a reform plan with specific timelines. That case concerns cloud email, not Excel memory corruption, and is not evidence that the same attackers or failures apply here.

Microsoft's November 2025 Secure Future Initiative report self-reports improvements including broader secure defaults in Azure, stronger hardware trust, and memory safety work in Windows and Surface firmware and drivers. Those initiatives do not establish that Excel's affected code was memory safe. For this specific CVE, the concrete response artifacts are the advisory, the exploitability assessment, the affected product records, and the explicit server patch.

References

• MSRC Security Update Guide: CVE-2026-120789
• NVD: CVE-2026-120789
• CVE Record: CVE-2026-120789
• Security update for Office Online Server: November 10, 2026 (KB5002946)
• Microsoft Office Security Releases
• Release notes for Microsoft Office security updates (Microsoft Learn)
• Update history for Office for Mac (Microsoft Learn)
• Update Office for Mac automatically (Microsoft Support)
• MITRE CWE-122: Heap based Buffer Overflow
• OffSeq Threat Radar: CVE-2026-120789
• Security Risk Advisors: November 2026 Microsoft Patch Tuesday
• Qualys: Microsoft Patch Tuesday, November 2026 Security Update Review
• Cyber Security Agency of Singapore: November 2026 Monthly Patch
• CISA Known Exploited Vulnerabilities Catalog
• Microsoft Security Blog: Secure Future Initiative November 2025 progress report
• Microsoft 2026 Annual Report
• DHS: Cyber Safety Review Board report on the summer 2023 Microsoft Exchange Online incident
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion (PDF)
• Bloomberg: Microsoft Excel Powers an AI Resistant, Multitrillion Dollar Empire