Brief Summary: Microsoft Excel CVE-2026-123385 Stack-Based Buffer Overflow Leading to Remote Code Execution

Introduction

Before Microsoft's November 10, 2026 Patch Tuesday release, a specially crafted Excel workbook could trigger a stack-based buffer overflow leading to code execution on Windows installations of Microsoft 365 Apps, Office LTSC 2021 and Office LTSC 2024. Workbooks are routinely exchanged between colleagues, partners and customers, so a memory corruption bug reachable through a file is relevant to almost every Office deployment, even though Microsoft rated exploitation as Less Likely at publication.

This post summarizes what Microsoft and the CVE record have published about CVE-2026-123385: how the bug is classified and scored, what the attack scenario looks like, which builds fix it, and a source inconsistency worth knowing about if you track patches by application name.

Technical information

Root cause

Microsoft's Security Update Guide titles this issue "Microsoft Office Excel Remote Code Execution Vulnerability" and classifies it as CWE-121: Stack-based Buffer Overflow. The published description is short: a stack-based buffer overflow in Excel allows an unauthorized attacker to execute code over a network.

Excel is closed source, and Microsoft has not published root cause details. There is no public commit, diff, vulnerable function name, memory layout description or exploit chain to examine. As general background only, fixes for stack overflows of this type usually add a length or bounds check before data taken from a file is copied into a fixed-size buffer on the stack. Microsoft has not confirmed that this is what changed for CVE-2026-123385, so treat that as context about the bug class rather than a statement about this specific fix.

Severity scoring

The CVE record carries the following CVSS 3.1 vector, with a base score of 8.8 (HIGH):

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Breaking that down:

• AV:N (network): the attack is network reachable, which is how a malicious file delivered remotely is represented.
• AC:L (low complexity) and PR:N (no privileges required).
• UI:R (user interaction required): a victim has to open the file and take further actions, described below.
• S:U (scope unchanged) with C:H / I:H / A:H: full impact to confidentiality, integrity and availability, consistent with code execution.
• E:U (exploit code maturity unproven), RL:O (official fix available, which Microsoft defines as "a complete vendor solution is available"), and RC:C (report confidence confirmed).

Microsoft's own severity rating is Important. The CVSS HIGH label and Microsoft's Important rating come from different severity schemes and do not contradict each other.

Attack flow

Based on Microsoft's advisory, exploitation follows this sequence:

1. The attacker prepares a specially crafted Excel workbook designed to trigger the stack-based overflow.
2. The workbook reaches the target user over a network.
3. The user opens the workbook in a vulnerable build of Excel.
4. The user enables editing for the document.
5. The user allows the workbook's accompanying content to load.
6. The overflow is triggered, and the attacker can achieve code execution.

Microsoft states explicitly that the Preview Pane is not an attack vector. Previewing the file is not described as sufficient. The scenario depends on the user opening it, enabling editing and allowing content to load.

What the sources do not tell us

The reviewed sources do not describe the specific file structure or record type involved, the stack layout, any mitigation bypass techniques, or post-exploitation behavior. We have not inferred any of those details here.

Patch information

Microsoft fixed CVE-2026-123385 on November 10, 2026, as part of that month's Patch Tuesday. Every affected product entry in the MSRC API has the status "productStatus":"fixed", and each is flagged customerActionRequired: true. The advisory has a single revision (1.0, "Information published," November 10, 2026), so Microsoft has not reissued or changed the fix since release.

How the fix is delivered

The fix ships as a new Office binary build. Modern Office uses Click to Run, which moves the whole suite to a new build number rather than shipping a separate Excel-only package. To confirm whether a machine is patched, compare its Office build number with the fixed builds below. On an individual machine, the build is shown under File > Account > About Excel.

Fixed builds by product (from the MSRC advisory and API)

• Microsoft Office LTSC 2021 (x86 and x64): vulnerable from 16.0.1 up to, but not including, the fixed build. Fixed build 16.0.14334.21048 (Version 2108).
• Microsoft Office LTSC 2024 (x86 and x64): vulnerable from 16.0.0 up to, but not including, the fixed build. Fixed build 16.0.17932.21140 (Version 2408).
• Microsoft 365 Apps for Enterprise (x86 and x64): vulnerable from 16.0.1 up to the current security release. MSRC points to Office Security Releases rather than a single build, because the fixed build depends on your update channel.

That adds up to six update entries: three products, each in a 32-bit and a 64-bit edition.

Microsoft 365 Apps builds by channel

The November 10, 2026 Office security release notes list these patched builds:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office 2024 / Office 2021 Retail: Version 2610 (Build 20527.20196)
• Office LTSC 2024 Volume Licensed: Version 2408 (Build 17932.21140)
• Office LTSC 2021 Volume Licensed: Version 2108 (Build 14334.21048)

The LTSC builds in the release notes match the MSRC fixedBuildNumber values exactly, so the two sources agree on those.

A mismatch between Microsoft sources

MSRC and NVD both describe this as an Excel vulnerability. In Microsoft's November 10, 2026 Office security release notes, however, CVE-2026-123385 appears under the Outlook heading rather than in the Excel list. The fix ships in the same suite-wide Click to Run build either way, so this does not change what you need to install. It does matter if your vulnerability management tooling maps fixes by application name. In that case, rely on the MSRC advisory and its build numbers.

Workarounds

Microsoft does not document a separate workaround. Since the Preview Pane is not an attack vector, disabling it is not a mitigation supported by the advisory. Installing the security update is the documented remediation.

Affected systems and versions

The MSRC advisory lists only Windows editions of the following products. No Mac builds appear among its fixed products.

• Microsoft Office LTSC 2021, 32-bit and 64-bit: versions 16.0.1 up to, but not including, 16.0.14334.21048
• Microsoft Office LTSC 2024, 32-bit and 64-bit: versions 16.0.0 up to, but not including, 16.0.17932.21140
• Microsoft 365 Apps for Enterprise, 32-bit and 64-bit: versions from 16.0.1 up to the current security release for each channel, with the upper boundary defined by the channel-specific builds listed in the Office security release notes

The vulnerable configuration is any of the above installations below its fixed build where a user opens a crafted workbook, enables editing, and allows its content to load.

References

• NVD entry for CVE-2026-123385
• CVE record for CVE-2026-123385
• Microsoft Security Update Guide: Microsoft Office Excel Remote Code Execution Vulnerability
• MSRC API affected product data for this CVE
• Microsoft 365 Apps security updates release notes
• Office Security Releases build number reference
• Microsoft Security Response Center
• Microsoft Bounty Programs
• Microsoft 2025 Annual Report
• Microsoft Form 10K filing for fiscal 2025