Introduction
Microsoft's November 10, 2026 Patch Tuesday release closed a heap memory corruption flaw in Excel that can let a crafted workbook run code with the privileges of the user who opens it. The affected product list spans Windows desktop Office, three Mac product families, and Office Online Server, so for most teams the practical work is confirming that every Excel deployment actually received the November build. That matters more than the severity label.
Technical information
Root cause
CVE-2026-120790 is classified as CWE-122, Heap based Buffer Overflow. MITRE defines this weakness as writing beyond the end of a buffer allocated on the heap. Across the weakness class, consequences can include memory corruption and arbitrary code execution. Those describe the class as a whole and are not a published reconstruction of this particular Excel flaw.
Excel is closed source, and Microsoft ships the fix as updated Excel and Office binaries. There is no public commit, diff, or vulnerable code to examine. The MSRC advisory does not identify the affected workbook features, the parser or record type involved, the vulnerable function, or a malformed file structure, so the exact bounds check Microsoft changed is not public. As general background, fixes for CWE-122 bugs usually validate the length of untrusted input against the size of the heap buffer before copying, or correct the buffer size calculation. Microsoft has not confirmed which, if either, applies here.
The NVD record was published on November 10, 2026 (timestamp 19:20:28.220), modified the same day at 21:18:59.677, and was in Undergoing Analysis status at the time of our review. The source identifier is [email protected].
Attack flow
Microsoft's FAQ is the only authoritative description of how exploitation works. Based on it, the documented sequence is:
- The attacker prepares a specially crafted workbook aimed at the affected workbook features.
- The attacker convinces a target user to open that workbook in Excel. No prior attacker privileges are required.
- The user opens the workbook and interacts with the affected workbook features. Microsoft explicitly states that the Preview Pane is not an attack vector, so merely previewing the file is not the documented trigger.
- The heap overflow is triggered, and successful exploitation could execute code in the context of the signed-in user.
The short NVD description says the flaw allows code execution "over a network." Read alongside the FAQ, that wording reflects remote delivery of the file, not a remotely triggered attack that needs no user participation. Execution in the victim's user context also does not imply administrator or SYSTEM access.
The sources leave the trigger implementation, heap layout, and any mitigation bypass undisclosed. Nothing in the advisory supports claims about a specific file extension, a macro requirement, a format conversion step, or a sandbox escape, and we have not added any.
Reading the CVSS vector
Microsoft's base vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which NVD attributes to Microsoft (NIST has not supplied its own score):
- Attack Vector: Network. The attack can be conducted remotely.
- Attack Complexity: Low. No specialized access conditions are required.
- Privileges Required: None. The attacker needs no prior privileges.
- User Interaction: Required. A separate user must participate.
- Scope: Unchanged. Impact stays within the same security authority.
- Confidentiality, Integrity, Availability: High. Serious impact on all three is possible.
The base score is 8.8 (High), while Microsoft's own severity rating is Important. Microsoft also publishes a temporal score of 7.7, with Exploit Code Maturity Unproven, Remediation Level Official Fix ("A complete vendor solution is available"), and Report Confidence Confirmed.
Exploitation status
Microsoft frames its exploitability data as an assessment at the time of original publication. For the November 10, 2026 release it records:
- Exploited: No
- Publicly disclosed: No
- Exploitability assessment: Exploitation Less Likely
- Exploit Code Maturity: Unproven
ZDI's November review agrees (Important, 8.8, not public, not exploited). Senserva reported no known exploitation as of November 10, 2026, no known ransomware use, and no CISA Known Exploited Vulnerabilities catalog listing. BleepingComputer reports that the only zero day patched that month was the Outlook spoofing bug, CVE-2026-124194. At least one upstream source described this Excel fix as a critical, actively exploited zero day, and the primary sources do not support that. The fix shipped as routine Patch Tuesday remediation rather than an emergency out-of-band release.
No threat actor, campaign, malware family, domain, or file hash is associated with this CVE in the Microsoft advisory, the NVD entry, or the CVE record. These are point-in-time assessments and should not be read as a guarantee that exploitation cannot occur.
Senserva characterizes the issue as Mac only, even though its own affected product list includes Windows products and Office Online Server. The Microsoft advisory, CVE record, and NVD data establish the broader scope, and a Mac-only remediation plan would miss listed products.
Patch information
Microsoft fixed CVE-2026-120790 in the November 10, 2026 Patch Tuesday release. Microsoft and NVD treat any build below the versions listed here as vulnerable. Updating to these versions or later applies the fix.
Fixed builds by product:
- Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140, delivered via Click to Run, Version 2408
- Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048, delivered via Click to Run, Version 2108
- Office Online Server: 16.0.10417.20236, delivered as KB5002946 or the Download Center package
- Microsoft 365 for Mac, Office LTSC for Mac 2021 and 2024: 16.115.26110837, per the Office for Mac release notes
- Microsoft 365 Apps for Enterprise (32 bit and 64 bit): per channel builds, listed below
For Microsoft 365 Apps, MSRC does not give a single version number. It points to Microsoft's Office security release notes, which list CVE-2026-120790 under Excel in the November 10, 2026 update. The patched channel builds are:
- Current Channel: Version 2610 (Build 20527.20196)
- Monthly Enterprise Channel: 2610 (20527.20194), 2609 (20430.20264), 2608 (20326.20320)
- Semi Annual Enterprise Channel: 2610 (20527.20192), 2609 (20430.20262), 2608 (20326.20318)
- Office 2024 and 2021 Retail: Version 2610 (Build 20527.20196)
Office Online Server note. MSRC links Office Online Server to KB5002946, but that support article returned a 404 when it was checked, so use the Download Center package linked from the MSRC advisory instead. Treat the server update as a separate deployment. A desktop Office update does not cover it.
Bundled fixes. This fix ships in the same monthly Office build as dozens of other November 2026 Excel CVEs, including CVE-2026-120785, CVE-2026-120786, CVE-2026-120788, CVE-2026-120789, and CVE-2026-120791. The fix for CVE-2026-120790 cannot be installed on its own. Updating to the November build or later addresses all of them together.
Verifying installation. On Windows, check the version and build under File > Account > About Excel and compare it with the channel builds above. Microsoft's update guidance also documents a manual check via File > Account > Update Options > Update Now. The same guidance notes that Office downloads updates in the background and applies them at the next opportunity, such as when Office applications close, so a downloaded update is not necessarily an applied one. On macOS, Excel should report version 16.115 (build 26110837) or later.
Microsoft has not published a separate workaround for this CVE. No registry change, macro setting, or file blocking rule is documented as a substitute for the update.
Affected systems and versions
The affected ranges below come from the Microsoft-supplied CVE record. The lower bounds reproduce the vendor's version metadata and do not imply that every historical release was separately tested.
- Microsoft 365 Apps for Enterprise (32 bit and x64): from 16.0.1, below the Office security release threshold for the relevant channel
- Microsoft Office 365 for Mac: from 1.0.0 up to, but not including, 16.115.26110837
- Microsoft Office LTSC 2021 (32 bit and x64): from 16.0.1 up to, but not including, 16.0.14334.21048
- Microsoft Office LTSC 2024 (32 bit and x64): from 16.0.0 up to, but not including, 16.0.17932.21140
- Microsoft Office LTSC for Mac 2021: from 16.0.1 up to, but not including, 16.115.26110837
- Microsoft Office LTSC for Mac 2024: from 16.0.0 up to, but not including, 16.115.26110837
- Office Online Server: from 16.0.0.0 up to, but not including, 16.0.10417.20236
The input data listed the vendor as Unknown. The CVE record identifies Microsoft as both the affected vendor and the CNA.
Vendor security history
The Cyber Safety Review Board's investigation of the 2023 Exchange Online intrusion concluded that the intrusion was preventable and should never have occurred, and identified decisions pointing to a culture that deprioritized enterprise security investment and rigorous risk management. The Board also criticized Microsoft's handling of information that later proved inaccurate and recommended prompt correction of significant factual errors. Those findings concern a separate Exchange incident and say nothing about the root cause or exploitation of this Excel bug.
On the other side of the ledger, Microsoft's July 2026 Secure Future Initiative progress report describes company-reported measures, including 99.97% phishing-resistant multifactor authentication coverage within its measurement scope, removal of 1.4M unused Entra applications, and remediation of more than 550,000 critical and high-risk open-source vulnerability instances. These figures describe the scale of Microsoft's security program. They do not independently validate this fix or measure residual exposure to it. For CVE-2026-120790, the directly relevant deliverable is the product-specific update.
References
- Microsoft Security Update Guide: CVE-2026-120790
- NVD: CVE-2026-120790
- CVE Record: CVE-2026-120790
- NVD API record for CVE-2026-120790
- Release notes for Microsoft Office security updates
- Office Online Server security update KB5002946
- Keep Office apps up to date with the latest updates
- Update history for Office LTSC 2024 and Office 2024
- Update history for Office LTSC 2021 and Office 2021
- Release notes for Office for Mac
- Zero Day Initiative: The November 2026 Security Update Review
- BleepingComputer: Microsoft November 2026 Patch Tuesday coverage
- Cisco Talos: Microsoft Patch Tuesday for November 2026
- Senserva: CVE-2026-120790 summary
- OffSeq Threat Radar: CVE-2026-120790
- MITRE CWE-122: Heap based Buffer Overflow
- Microsoft 2026 Annual Report
- Microsoft Secure Future Initiative overview
- SFI Progress Report July 2026
- Cyber Safety Review Board: Review of the Summer 2023 Microsoft Exchange Online Intrusion
