Introduction
Excel workbooks are among the most routinely exchanged files in enterprise environments, so a memory corruption flaw in the code that opens them turns an ordinary document into a possible path to code execution on the recipient's machine. Microsoft's November 10, 2026 Patch Tuesday release addresses one such issue in CVE-2026-124176, a heap-based buffer overflow that reaches across Microsoft 365 Apps, Office LTSC on Windows and Mac, and Office Online Server.
This post is a brief summary of what the public record says: the MSRC advisory, the CVE and NVD entries, the Office Online Server KB article and Microsoft's Office release notes. The raw CVE feed lists the vendor as Unknown. The MSRC advisory and the CNA record both identify Microsoft as the affected vendor and assigning CNA.
Technical information
Root cause: a CWE 122 heap overflow
Microsoft classifies the weakness as CWE 122, Heap based Buffer Overflow. MITRE defines this class as writing beyond the end of a buffer allocated on the heap. That makes it a heap memory error, unlike the stack buffer overflow seen in some other Excel advisories.
MITRE's description of the class explains that heap overflows can overwrite adjacent data such as function pointers and redirect execution toward attacker-controlled code, and that buffer overflows can also simply crash the process. Those are general properties of the weakness class. Microsoft has not disclosed which parser, record type, memory object or bounds check is involved in this specific CVE, and Excel is closed source, so there is no public commit or diff to inspect.
Scoring
The CNA published the following CVSS 3.1 base vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Base score: 8.8 (High in NVD) Temporal score: 7.7 (E:U / RL:O / RC:C)
- Attack vector, Network: the flaw is classified as remotely reachable, meaning the malicious input can arrive over a network.
- Attack complexity, Low: no specialized access conditions or extenuating circumstances are required.
- Privileges required, None: the attacker needs no prior access to the target.
- User interaction, Required: a user must act before exploitation succeeds.
- Scope, Unchanged: impact stays within the same security authority.
- Confidentiality, Integrity, Availability, High: successful exploitation has severe effects in all three.
Two labels circulate for this CVE, and they do not conflict. NVD lists the 8.8 base score as High, while Microsoft's own product severity rating is Important. These come from different rating systems. The temporal metrics describe the state at publication: exploit maturity Unproven (E:U), an Official Fix available (RL:O) and Confirmed report confidence (RC:C).
The vector pairs AV:N with UI:R. Network delivery does not mean automatic exploitation of any connected system, and Microsoft's CVE-specific FAQ makes clear that a file must be opened.
Attack flow
Based on the MSRC advisory, the disclosed exploitation sequence is:
- The attacker prepares a specially crafted file designed to trigger the heap overflow when Excel processes it.
- The attacker gets the file to a target user. Microsoft does not name a delivery channel, so email, web downloads or file shares should not be described as observed campaigns for this CVE.
- The user opens the file in Excel. Microsoft explicitly states that the Preview Pane is not an attack vector, so simply previewing the file is not the documented trigger.
- While Excel loads and parses the crafted content, the out-of-bounds heap write occurs, which can lead to remote code execution.
The Preview Pane exclusion points toward the vulnerable code sitting in Excel's file loading and parsing path rather than in preview handlers.
What the public record does not say
The advisory and CVE record do not disclose a specific file extension, malformed record structure, vulnerable function, exploit payload, memory corruption offset, or the privilege level at which resulting code runs. They also do not state whether macros are involved. Office Online Server is separately listed as affected, but the reviewed material does not describe a distinct server-side exploitation sequence for it. The only documented trigger remains a user opening a crafted file.
Exploitation status at publication
At original publication, Microsoft's advisory recorded:
- Publicly disclosed: No
- Exploited: No
- Exploitability assessment: Exploitation Less Likely
The "Publicly disclosed: No" field refers to the state of knowledge before Microsoft's release. It does not claim that the advisory itself is secret. Unproven exploit maturity means no public exploit code is available or exploitation is theoretical, which does not mean exploitation is impossible.
As a secondary source, OffSeq's Threat Radar record for November 10, 2026 reported no indexed public exploit code in Metasploit or Exploit DB, no indexed Nuclei template, and no attack traffic recorded by its Mirage sensors for this CVE. OffSeq itself cautions that missing data is not evidence of safety.
The reviewed sources tie no threat actor, malware family, ransomware operation or campaign to this CVE, and no campaign-specific indicators of compromise have been published. Microsoft credits namnp with Viettel Cyber Security and vietnq for the discovery. These are researcher acknowledgments, not attacker attribution.
So high potential impact and low observed activity coexist here. The first describes what successful exploitation could do, and the second describes what has been reported so far.
Patch information
Microsoft fixed CVE-2026-124176 in the November 10, 2026 Patch Tuesday release, and the MSRC advisory marks the remediation level as Official Fix. Because Microsoft has not published root-cause details, build numbers are the only reliable way to confirm a system carries the patched Excel code. If a build is at or above the fixed build for its product, it has the fix.
Fixed builds by product
- Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048 (Version 2108), delivered as a Click to Run security update.
- Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140 (Version 2408), delivered as a Click to Run security update.
- Microsoft Office 365 for Mac, Office LTSC for Mac 2021 and Office LTSC for Mac 2024: 16.115.26110837, delivered through Microsoft AutoUpdate and documented in the Mac release notes.
- Office Online Server: 16.0.10417.20236, delivered as KB5002946.
- Microsoft 365 Apps for Enterprise (32 bit and 64 bit): per channel, with MSRC pointing to aka.ms/OfficeSecurityReleases.
Microsoft 365 Apps channel builds
Microsoft 365 Apps has no single fixed version. Microsoft's "Release notes for Microsoft Office security updates" page lists CVE-2026-124176 under the Office suite section for the November 10, 2026 release with these builds:
- Current Channel: Version 2610 (Build 20527.20196)
- Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
- Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
- Office 2024 and Office 2021 Retail: Version 2610 (Build 20527.20196)
Click to Run updates are cumulative, so any later build on the same channel also includes the fix.
Office Online Server: KB5002946
Office Online Server is the one product where the fix ships as a standalone package. KB5002946 is a cumulative, Excel-focused update that covers CVE-2026-124176 along with many other Excel remote code execution and information disclosure CVEs from the same cycle, including CVE-2026-124172, CVE-2026-124174 and CVE-2026-124179.
- Build: 16.0.10417.20236
- Prerequisite: the release version of Office Online Server must already be installed.
- Supersedes: KB5002928, so only the newest package needs to be installed.
- Distribution: Microsoft Update, the Microsoft Update Catalog, or the Microsoft Download Center (download ID 108899). With automatic updating enabled, the update downloads and installs automatically. Otherwise, follow the installation instructions on the download page.
- Changed files: Microsoft publishes the list as a CSV linked from the KB article, which is useful if you plan to diff the binaries yourself.
Verify the package hash before staging it on servers:
Package: wacserver2019-kb5002946-fullfile-x64-glb.exe SHA256: F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0
The KB article does not provide farm sequencing or restart guidance, so we are not adding any here.
Office for Mac
Microsoft's Mac update history identifies the November 10, 2026 release as version 16.115, build 26110837, matching the boundary in the CNA record. For Microsoft AutoUpdate installs, open any Office app, select Help > Check for Updates, enable Automatically keep Microsoft apps up to date, and select Update. For apps installed from the Mac App Store, open the store, select Updates, and choose Update All or the individual app.
Workarounds
No CVE-specific workaround is documented. Because Microsoft explicitly rules out the Preview Pane as an attack vector, disabling it does not mitigate this issue. MITRE's general CWE 122 guidance (automatic and explicit bounds checking) applies to software development and is not a substitute for the Office update.
Affected systems and versions
The CNA record lists the following affected ranges. The upper boundary is exclusive: versions below it are affected.
- Microsoft 365 Apps for Enterprise: from 16.0.1, with no single numeric upper boundary. Microsoft refers to its Office Security Releases guidance (see channel builds above).
- Microsoft Office 365 for Mac: from 1.0.0 up to, but not including, 16.115.26110837.
- Microsoft Office LTSC 2021: from 16.0.1 up to, but not including, 16.0.14334.21048.
- Microsoft Office LTSC 2024: from 16.0.0 up to, but not including, 16.0.17932.21140.
- Microsoft Office LTSC for Mac 2021: from 16.0.1 up to, but not including, 16.115.26110837.
- Microsoft Office LTSC for Mac 2024: from 16.0.0 up to, but not including, 16.115.26110837.
- Office Online Server: from 16.0.0.0 up to, but not including, 16.0.10417.20236.
These build numbers belong to different products and update channels. A Mac build, a Windows LTSC build and an Office Online Server package are not interchangeable, and Microsoft 365 Apps must be checked against the channel-specific build list rather than a common threshold.
Vendor security history
Microsoft's footprint in business software is large. The UK Competition and Markets Authority describes Microsoft's business software ecosystem as spanning Windows, Office applications, SQL database products and related access and security services. Its May 14, 2026 investigation notice cites a historical 80% to 90% share of supply band for Microsoft in the global productivity suites market in 2022 and several preceding years, and a 20M to 30M band of UK organizational users of Microsoft's productivity software in FY25. These are scoped historical figures, not a count of vulnerable devices, and the notice opens an investigation into possible strategic market status rather than making a final designation.
On security governance, the Cyber Safety Review Board reviewed the Summer 2023 Microsoft Exchange Online intrusion by an actor assessed as affiliated with the People's Republic of China. The Board concluded the intrusion was preventable and identified decisions pointing to a corporate culture that deprioritized enterprise security investment and rigorous risk management. Microsoft cooperated fully with the review.
In its June 2024 response, Microsoft accepted responsibility, said it is acting on all 16 recommendations applicable to it, and added 18 concrete security objectives under its Secure Future Initiative, which emphasizes Secure by Design, Secure by Default and Secure Operations. Microsoft also described an expanded Office of the CISO and tying senior leadership compensation to security progress.
None of this connects the Exchange incident to CVE-2026-124176. It is context on vendor governance. For this specific CVE, Microsoft's coordinated disclosure, researcher credits and product-specific fixes show a functioning remediation process.
References
- NVD entry for CVE-2026-124176
- CVE Record for CVE-2026-124176
- Microsoft Security Update Guide: CVE-2026-124176 Microsoft Office Excel Remote Code Execution Vulnerability
- Security update for Office Online Server: November 10, 2026 (KB5002946)
- Release notes for Microsoft Office security updates
- Update history for Office for Mac
- Update Office for Mac automatically
- MITRE CWE 122: Heap based Buffer Overflow
- OffSeq Threat Radar record for CVE-2026-124176
- Qualys: Microsoft Patch Tuesday, November 2026 Security Update Review
- Tenable Nessus plugin 378503: Security Updates for Microsoft Office Products (November 2026)
- CISA: Cyber Safety Review Board Report on Summer 2023 Microsoft Online Exchange Incident
- DHS: Cyber Safety Review Board Releases Report on Microsoft Online Exchange Incident
- Microsoft On the Issues: Microsoft's work to strengthen cybersecurity protection
- UK CMA Investigation Notice
- UK CMA: Actions on cloud and business software through the UK digital markets competition regime
