Brief Summary: Microsoft Excel CVE-2026-124187 Use After Free Leading to Code Execution via Tracked Changes

Introduction

A crafted Excel workbook, opened by a user who then reviews its tracked changes, is enough to trigger a memory lifetime bug in Excel that can run attacker code with that user's privileges. Microsoft fixed the issue on November 10, 2026 across Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and Office for Mac, so the practical question for most teams is which machines in their fleet are still running a build below the fixed boundary.

This post is a brief summary of CVE-2026-124187 based on Microsoft's advisory and update guide data, the CVE record, NVD, the Office security release notes, and Tenable's plugin documentation. The NVD feed lists the vendor as Unknown, but Microsoft is both the vendor and the assigning CNA.

Technical information

Root cause: use after free (CWE-416)

Microsoft classifies the flaw as CWE-416, Use After Free, and describes it as a use after free in Microsoft Office Excel that allows an unauthorized attacker to execute code over a network.

MITRE defines this weakness as referencing memory after it has been freed. Once released, that memory can be allocated to a different object while an older pointer still refers to it, so operations through the stale pointer act on data the code no longer owns. Depending on the implementation, the outcome ranges from data corruption and information exposure to arbitrary code execution. Those are properties of the weakness class. Microsoft has not disclosed Excel's internal mechanism.

Microsoft has disclosed the code path: the bug is reached when a user opens a crafted workbook and reviews tracked changes. The advisory does not provide vulnerable function names, a specific workbook file extension, an allocation and free sequence, or exploit construction details, and no vulnerable code is public because Excel is closed source.

CVSS breakdown

Microsoft's full vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• Base score: 8.8, High. Microsoft's own product severity rating is Important. These are different rating systems rather than conflicting assessments.
• AV:N: network attack vector.
• AC:L: low attack complexity.
• PR:N: the attacker needs no prior privileges.
• UI:R: a user must take action.
• S:U: impact stays within the same security authority.
• C:H/I:H/A:H: high potential impact to confidentiality, integrity, and availability.
• Temporal score: 7.7, reflecting E:U (Unproven), RL:O (Official Fix), and RC:C (Confirmed).

NVD currently displays Microsoft's CNA score and states that an independent NVD assessment has not yet been provided.

The AV:N rating is easy to misread. Microsoft pairs the network vector with required user interaction and explicitly excludes the Preview Pane. The scenario is attacker-supplied document execution that depends on the recipient participating, not an unattended attack against an exposed Excel service.

Attack flow

Based on Microsoft's FAQ, the documented scenario is:

1. The attacker prepares a specially crafted Excel workbook.
2. The attacker provides the workbook to a target and convinces the user to open it in Excel. Viewing it in the Preview Pane does not trigger the bug.
3. The attacker persuades the user to review the tracked changes in the workbook, which reaches the vulnerable object lifetime handling.
4. On success, code executes in the context of the user running Excel.

The advisory does not claim automatic elevation to administrator or SYSTEM. Post-exploitation privileges equal those of the user who opened the file.

Exploitation status

Microsoft's exploitability assessment, recorded at original publication:

• Exploited: No
• Publicly disclosed: No
• Exploitability: Exploitation Less Likely
• Exploit maturity: Unproven, meaning no publicly available exploit code or an exploit that is only theoretical

No threat actor or campaign is associated with this CVE in the sources we reviewed, and no malicious workbook sample, file hash, or network indicator has been published. The available CISA catalog excerpt does not establish whether the CVE is in the Known Exploited Vulnerabilities catalog, so we make no claim either way. The fair summary is high potential impact with no reported exploitation at publication, which is a point-in-time assessment rather than a guarantee.

Patch information

Fix status. Microsoft fixed CVE-2026-124187 in the November 10, 2026 Patch Tuesday release. Because Excel is closed source there is no public diff or commit. What is public comes from the advisory, Microsoft's update guide API, and the Office release notes. The temporal vector ends in RL:O, Official Fix, and the API marks every affected product row as "productStatus":"fixed" with "customerActionRequired":true. Excel is only protected once the patched build is actually installed. The advisory lists no vulnerability-specific workaround, so settings changes such as macro or Preview Pane policy are not established as a fix for this flaw.

Where the fix sits. Given the tracked changes trigger, the patch changes how Excel manages object lifetimes in that code path. Microsoft has not published the specific change. For this bug class, fixes typically add reference counting, clear dangling pointers after an object is freed, or recheck that an object still exists before reuse. Treat that as general background rather than a description of this fix.

How the fix is delivered. Modern Office is serviced through Click to Run builds rather than standalone KB installers, so confirming the fix means comparing build numbers. Fixed builds per Microsoft's update guide, API, and the November 10, 2026 release notes:

• Microsoft Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140 (Version 2408)
• Microsoft Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048 (Version 2108)
• Microsoft Office 365 for Mac, Office LTSC for Mac 2021, Office LTSC for Mac 2024: 16.115.26110837
• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): depends on the update channel. MSRC points to aka.ms/OfficeSecurityReleases

For Microsoft 365 Apps, the November 10, 2026 security release lists the following channel builds, with CVE-2026-124187 under the Excel heading:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: 2610 (Build 20527.20194), 2609 (Build 20430.20264), 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel (receives Monthly Enterprise Channel builds): 2610 (Build 20527.20192), 2609 (Build 20430.20262), 2608 (Build 20326.20318)
• Office 2024 Retail and Office 2021 Retail: Version 2610 (Build 20527.20196)

Checking an install. The October 13, 2026 release left Office LTSC 2024 at Build 17932.21056 and Office LTSC 2021 at Build 14334.20974. Machines on those builds or older do not have this fix. NVD's affected version data, sourced from Microsoft as the CNA, uses the same upper limits: LTSC 2021 is affected below 16.0.14334.21048 and LTSC 2024 below 16.0.17932.21140.

Bundled fixes. CVE-2026-124187 shipped in a large Excel rollup alongside dozens of other Excel CVEs in the same builds. There is no separate update for this issue. Moving to the November build fixes it together with the rest of that month's Excel fixes.

Detection methods

No public exploit signature, YARA rule, IDS rule, or IoC set exists for CVE-2026-124187. Given Microsoft's not disclosed, not exploited, Exploitation Less Likely assessment, detection today comes down to two things: finding hosts on vulnerable builds, which is reliable and backed by vendor data, and watching the delivery path Microsoft describes, which is behavioral and depends on your own telemetry.

1. Vulnerable Office for Mac installs via Tenable Nessus

Tenable Nessus plugin 378503, Security Updates for Microsoft Office Products (November 2026) (macOS), names CVE-2026-124187 among the Excel use-after-free RCEs it covers.

• It is a local check in the MacOS X Local Security Checks family (file macos_ms26_nov_office.nasl), run from Nessus or the Nessus Agent. It requires the Host/MacOSX/Version KB item, so the scan needs credentials or an installed agent.
• It flags Office for Mac versions older than 16.115.
• It does not test the bug. Tenable states that Nessus relies only on the version number the application reports about itself. A positive result means the host is exposed, not that it was attacked, and a spoofed or incorrect version string would skew the result.
• The plugin bundles many November 2026 Office CVEs. Filter by CVE ID to report on this one alone.

2. Build number checks on Windows and Mac

None of the verified sources point to a Windows Office plugin for this CVE. Any inventory source (EDR, SCCM/Intune, or similar) can still detect exposure by comparing installed builds with the fixed builds. Per MSRC and NVD, a host is vulnerable if its build is older than:

• Office LTSC 2021 (32/64 bit): 16.0.14334.21048
• Office LTSC 2024 (32/64 bit): 16.0.17932.21140
• Office 365 for Mac, Office LTSC for Mac 2021/2024: 16.115.26110837
• Microsoft 365 Apps for Enterprise: channel-specific builds listed at aka.ms/OfficeSecurityReleases

Because Microsoft 365 Apps for Enterprise uses rolling update channels, evaluate it per channel rather than against a single number.

3. Monitoring the delivery path

Microsoft's FAQ tells us an attacker must deliver a crafted workbook and persuade the user to open it and review tracked changes, that the Preview Pane is not a vector, and that code runs in the user's context. That points monitoring at:

• Mail and file gateways: scrutinize Excel workbooks arriving from outside the organization, especially unsolicited ones asking the reader to review edits. This is the only delivery method Microsoft describes.
• Endpoint behavior: code from a use after free runs inside Excel. Look for an Excel process starting child processes, opening unexpected network connections, or writing executables shortly after a user opens an externally sourced workbook. An Excel crash right after such a file is opened is also worth reviewing, since failed memory corruption attempts often crash the application. These are general Office RCE heuristics, not signatures for this CVE. Tune them against normal Excel activity.
• Lower priority for preview-only events: since the Preview Pane cannot trigger the bug, an alert showing a file only previewed, never opened and reviewed, is less likely to be exploitation of this CVE.

Exposure is reliably detectable today, but exploitation is not. Use the Nessus plugin on Macs, check build numbers fleet wide, and keep behavioral monitoring on Excel until vendors ship CVE-specific content.

Affected systems and versions

Per the CVE record, which uses the same fixed boundaries as NVD and MSRC:

• Microsoft 365 Apps for Enterprise (32 bit and x64): from 16.0.1, with the upper boundary supplied through Microsoft's Office security release information and varying by update channel (see the channel builds above).
• Microsoft Office LTSC 2021 (32 bit and x64): from 16.0.1 up to, but not including, 16.0.14334.21048.
• Microsoft Office LTSC 2024 (32 bit and x64): from 16.0.0 up to, but not including, 16.0.17932.21140.
• Microsoft Office 365 for Mac: from 1.0.0 up to, but not including, 16.115.26110837.
• Microsoft Office LTSC for Mac 2021: from 16.0.1 up to, but not including, 16.115.26110837.
• Microsoft Office LTSC for Mac 2024: from 16.0.0 up to, but not including, 16.115.26110837.

The vulnerable configuration is any of these builds where a user opens an untrusted workbook in Excel and reviews its tracked changes. Previewing a file in the Preview Pane is not a documented trigger.

Vendor security history

Microsoft's footprint makes its security record relevant to enterprise risk decisions. The Cyber Safety Review Board describes Microsoft's products as ubiquitous and critical to essential services supporting national security, the economy, and public health and safety, and refers to more than one billion customers.

The Board's review of the 2023 Exchange Online intrusion concluded that the incident was preventable, that Microsoft's security culture was inadequate and required an overhaul, and that a series of decisions deprioritized enterprise security investment and rigorous risk management. That case involved an actor holding a signing key and accessing enterprise Exchange accounts. It is a different product and mechanism, and neither its findings nor its attribution should be transferred to this Excel bug.

On the reform side, Microsoft's July 2026 Secure Future Initiative progress report states that phishing-resistant MFA enforcement has reached 99.97% user and device coverage and that automated container patching addresses about 3 million vulnerability instances each month. These are vendor-reported outcomes for identity and infrastructure controls. They are not evidence that application-level memory safety defects like this use after free have been eliminated. For this specific exposure, the advisory and fixed build boundaries remain the most directly useful evidence.

References

• NVD: CVE-2026-124187
• CVE Record: CVE-2026-124187
• Microsoft Security Update Guide: CVE-2026-124187
• MSRC update guide API: affected products for CVE-2026-124187
• Release notes for Microsoft Office security updates
• Update history for Office for Mac
• Update history for Microsoft 365 Apps (listed by date)
• Overview of Office for Mac for admins and IT Pros
• Rapid7: Patch Tuesday, November 2026
• Tenable Nessus plugin 378503: Security Updates for Microsoft Office Products (November 2026) (macOS)
• MITRE CWE-416: Use After Free
• CISA Known Exploited Vulnerabilities Catalog
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft Secure Future Initiative Progress Report, July 2026
• Microsoft FY26 Q4 Press Release