Brief Summary: Microsoft Excel CVE-2026-120791 Heap-Based Buffer Overflow Leading to User-Assisted Code Execution

Introduction

Microsoft's November 10, 2026 security release fixed a heap-based buffer overflow in Excel that can give an attacker code execution as the signed-in user once a crafted workbook is opened and its affected features are used. The affected list spans Microsoft 365 Apps, perpetual LTSC releases on both Windows and Mac, and Office Online Server, so no single build number tells you whether your estate is covered.

The supplied CVE data lists the vendor as Unknown. Microsoft is in fact both the vendor and the assigning CNA, and NVD attributes the 8.8 score to Microsoft Corporation. This brief summary sticks to what Microsoft, the CVE record, and the cited secondary sources publish, and calls out where the public record stops.

Technical information

Root cause

Microsoft describes CVE-2026-120791 as a heap-based buffer overflow in Microsoft Office Excel that allows an unauthorized attacker to execute code over a network. The assigned weakness is CWE-122.

MITRE defines CWE-122 as a write beyond the end of a buffer allocated on the heap. Typical outcomes for the class are crashes and, under the right conditions, arbitrary code execution through corruption of adjacent heap memory. These describe the weakness class in general. They are not a reconstruction of this specific Excel bug.

Microsoft has not published the affected function, workbook feature, record type, parser, memory layout, or a reproducible trigger. Excel is closed source, so there is no public commit or diff to inspect. Everything below is bounded by the CWE classification and the exploitation conditions in Microsoft's FAQ.

Attack flow as documented by Microsoft

1. The attacker prepares a specially crafted Excel workbook.
2. The attacker persuades a target user to open that workbook in Excel.
3. The user interacts with the affected workbook features. Microsoft does not identify which features.
4. The heap overflow is triggered during that processing.
5. On successful exploitation, code runs in the context of the signed-in user.

Two details narrow the scope. First, Microsoft states that the Preview Pane is not an attack vector, so receiving or previewing a workbook is not described as sufficient. Second, the scenario needs both opening the file and interacting with features. That makes this user-assisted remote code execution rather than a zero-interaction network attack.

Reading the CVSS vector

Microsoft's base vector and temporal extension:

Base:     CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H   (8.8)
Temporal: E:U/RL:O/RC:C                                  (7.7)

• AV:N, Attack Vector Network: the crafted file can be delivered remotely.
• AC:L, Attack Complexity Low: no specialized access conditions in the base assessment.
• PR:N, Privileges Required None: the attacker needs no prior privileges on the target.
• UI:R, User Interaction Required: a victim must open the workbook and interact with it.
• S:U, Scope Unchanged: impact stays within the same security authority.
• C:H / I:H / A:H: high potential confidentiality, integrity, and availability impact.
• E:U, Exploit Code Maturity Unproven.
• RL:O, Remediation Level Official Fix.
• RC:C, Report Confidence Confirmed.

PR:N and UI:R fit together. The attacker starts with no access but still depends on a user taking action. The rating systems also differ. CVSS says 8.8 HIGH, while Microsoft's own maximum severity label is Important, not Critical. NVD has not supplied an independent score, and the entry is still undergoing enrichment.

Exploitation status

At original publication, Microsoft listed the vulnerability as:

• Exploited: No
• Publicly disclosed: No (an initial assessment, and the advisory itself is now public)
• Exploitability: Exploitation Less Likely

Zero Day Initiative's November 2026 review agrees. It lists CVE-2026-120791 as an Important-rated Excel RCE (CVSS 8.8), not publicly disclosed and not exploited.

OffSeq's Threat Radar, with source coverage dated November 10, 2026, reported no indexed exploit code in Metasploit or Exploit Database, no indexed nuclei template, no CISA KEV listing, and no observed attack traffic on its Mirage sensors. Those findings are limited to the indexes and sensor network it checked, so they indicate absence of evidence rather than proof of absence. No cited source associates a threat actor, campaign, file hashes, domains, or network indicators with this CVE.

Exploitation Less Likely and 8.8 HIGH answer different questions. One is Microsoft's initial view of exploitation likelihood, the other is potential impact. Both can be true at once, and neither removes the need to install the official fix.

Patch information

Microsoft fixed CVE-2026-120791 in its November 10, 2026 Patch Tuesday release. The MSRC advisory sets Remediation Level to Official Fix (RL:O), which is what brings the 8.8 base score down to the 7.7 temporal score. The fix ships only as updated binaries, so the reliable way to confirm coverage is to compare build numbers. Any build below the listed number is vulnerable.

Fixed builds by product

• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): Click to Run channel update. There is no single fixed version. Each channel (Current, Monthly Enterprise, Semi Annual) has its own build, listed on Microsoft's Office security release notes. Look up your channel there and compare the installed build.
• Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140
• Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048
• Microsoft Office 365 for Mac: 16.115.26110837
• Microsoft Office LTSC for Mac 2021 and 2024: 16.115.26110837, the same shared Mac build, delivered through Microsoft AutoUpdate and documented in the Office for Mac release notes.
• Office Online Server: KB5002946, build 16.0.10417.20236

Office Online Server: KB5002946

Office Online Server renders workbooks on the server, so the vulnerable Excel parsing code runs there as well. Microsoft's advisory does not describe a distinct server exploitation sequence, though, so server inclusion should not be read as evidence of unattended server takeover. Details from the KB article:

• One package, many CVEs. KB5002946 lists several dozen Excel-related CVEs, including CVE-2026-120791. You cannot patch this CVE on its own on the server.
• Cumulative. It supersedes the earlier security update KB5002928.
• Prerequisite. The release version of Office Online Server must already be installed.
• Distribution. Microsoft Update, the Microsoft Update Catalog, and the Microsoft Download Center.
• Integrity check. Verify the standalone package hash before deploying to servers without internet access:

wacserver2019-kb5002946-fullfile-x64-glb.exe
SHA256: F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0

The KB carries generic wording about automatic installation through Microsoft Update, but Microsoft's product-specific Office Online Server guidance states that applying updates automatically is unsupported. An incorrectly applied update can stop document viewing or editing and may require rebuilding the farm. Microsoft's documented procedure:

• Single-server farm: remove the server from the farm, install the update, restart if prompted, and recreate the farm with the same internal URL and other original parameters. Office Online is unavailable during this window, so Microsoft recommends a noncritical or nonbusiness period.
• Multiple-server farm: remove a server from the load balancer and the farm, update it, and create the updated farm. Once enough updated servers can carry demand, move traffic to them, then update the remaining servers and join them to the updated farm. This sequence is designed to avoid user disruption.

Microsoft documents no CVE-specific configuration workaround that replaces installing the update.

What the fix most likely changes

Microsoft has not published root cause details beyond CWE-122 and the FAQ. Heap overflows in file parsers commonly occur when length or count fields read from the file control how much data is copied into a heap buffer allocated with a different, smaller size. Fixes for that class typically:

• validate length fields from the file against the size actually allocated before copying
• use checked arithmetic when computing allocation sizes so an integer overflow cannot produce an undersized buffer
• reject or stop parsing malformed records rather than continuing with inconsistent state

This describes the general class of fix only. It is not confirmed for Excel, because Microsoft has not disclosed which record type or function changed.

Affected systems and versions

Per the CVE record and NVD, the upper bound in each range is exclusive (that build and later are fixed):

• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): from 16.0.1, with no single numeric upper bound in the CVE record. The record points to Microsoft's Office Security Releases page for per-channel builds.
• Microsoft Office LTSC 2024 (32 bit and 64 bit): from 16.0.0 up to but not including 16.0.17932.21140
• Microsoft Office LTSC 2021 (32 bit and 64 bit): from 16.0.1 up to but not including 16.0.14334.21048
• Microsoft Office 365 for Mac: from 1.0.0 up to but not including 16.115.26110837
• Microsoft Office LTSC for Mac 2021: from 16.0.1 up to but not including 16.115.26110837
• Microsoft Office LTSC for Mac 2024: from 16.0.0 up to but not including 16.115.26110837
• Office Online Server: from 16.0.0.0 up to but not including 16.0.10417.20236 (fixed by KB5002946)

The scope is broader than the short Excel description suggests. Mac installations and Office Online Server farms belong in the inventory alongside Windows desktops.

Vendor security history

Microsoft's footprint in business software is large. The UK Competition and Markets Authority's provisional findings of October 16, 2026 describe a strong position across productivity suites, PC and server operating systems, security software, and relational databases, and propose strategic market status for its business software ecosystem. Those findings remain provisional and subject to consultation.

The most widely cited recent case in Microsoft's track record is the Cyber Safety Review Board's review of the 2023 Exchange Online intrusion. The Board attributed the operation to Storm-0558, assessed as affiliated with the People's Republic of China. The intrusion affected 22 organizations and more than 500 individuals in May and June 2023, using tokens signed with a Microsoft key created in 2016. The Board described a cascade of security failures at Microsoft and recommended prioritizing security over feature development where necessary. Microsoft launched its Secure Future Initiative in November 2023, built around secure by design, secure by default, and secure operations, including faster vulnerability response and remediation.

None of this connects Storm-0558 or any other actor to CVE-2026-120791. For this vulnerability, the actionable vendor deliverables are the advisory, the version boundaries, and the official updates.

References

• Microsoft Security Update Guide: CVE-2026-120791
• NVD entry for CVE-2026-120791
• CVE Record: CVE-2026-120791
• CVE List V5 JSON record for CVE-2026-120791
• Microsoft Support: Security update for Office Online Server, KB5002946
• Microsoft Download Center: KB5002946 for Office Online Server
• Microsoft Learn: Apply software updates to Office Online Server
• Microsoft Learn: Release notes for Microsoft Office security updates
• Zero Day Initiative: The November 2026 Security Update Review
• MITRE CWE-122: Heap based Buffer Overflow
• OffSeq Threat Radar: CVE-2026-120791
• Senserva: CVE-2026-120791 Office Online Server fix KB5002946
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft Secure Future Initiative
• GOV.UK: CMA takes first steps to ensure choice in business software
• Microsoft 365 product overview