Introduction
A heap buffer overflow in Microsoft Office Excel, fixed in the November 10, 2026 Patch Tuesday release, can let an attacker run code as the signed-in user once that user opens a specially crafted workbook and interacts with affected workbook features. The affected product list spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, the Mac editions and Office Online Server, so remediating CVE-2026-120788 touches both desktop fleets and server farms.
Microsoft scores the issue at CVSS 3.1 base 8.8 (High) and assigns it a vendor severity of Critical. The two ratings come from separate classification systems and do not conflict. At original publication, Microsoft reported no known exploitation and rated exploitation as less likely.
Technical information
Root cause
Microsoft's description is short: "Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network." The weakness is classified as CWE-122, which MITRE defines as a write past the end of a buffer allocated on the heap. The general consequences of that class range from application crashes to, in some circumstances, arbitrary code execution.
Those are properties of the weakness class. They do not describe how this particular Excel bug is implemented. Excel is closed source, so there is no public commit, diff or vulnerable code to examine. The advisory does not disclose:
- the file format involved
- the parser routine or code path
- the heap allocation that is overrun
- the payload structure
- which workbook feature triggers the bug
We leave these as not publicly specified, and we have not borrowed details from other Excel vulnerabilities to fill the gaps.
Attack flow
The exploitation sequence Microsoft documents is narrower than the one-line description suggests:
- The attacker prepares a specially crafted Excel workbook.
- The attacker convinces a user to open the workbook in Excel. The advisory does not name a delivery channel.
- The user opens the workbook and then interacts with affected workbook features. Opening the file alone is not the documented trigger.
- The crafted content causes a heap buffer overflow in Excel.
- If exploitation succeeds, code runs in the context of the signed-in user. The advisory does not describe automatic administrator access.
Microsoft states explicitly that the Preview Pane is not an attack vector. The advisory also does not establish that macros, embedded charts or any specific delivery mechanism are required.
Reading the CVSS vector
Microsoft publishes the following base vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack Vector: Network. The advisory describes code execution over a network.
- Attack Complexity: Low. No specialized access conditions or extenuating circumstances are required.
- Privileges Required: None. The attacker needs no prior access to settings or files.
- User Interaction: Required. A user must take action before exploitation can occur.
- Scope: Unchanged. Impact stays within resources managed by the same security authority.
- Confidentiality, Integrity, Availability: High. The assessment allows total loss in each category within the impacted component.
Low complexity and required interaction measure different things. Complexity describes the technical conditions for exploitation, while interaction is a separate prerequisite, and neither cancels the other. A Network attack vector combined with UI:R should not be read as interactionless compromise.
The temporal score is 7.7, with E:U/RL:O/RC:C:
- E:U means exploit code maturity is Unproven.
- RL:O means an Official Fix exists.
- RC:C means the vulnerability itself is Confirmed. It does not mean malicious exploitation has been confirmed.
NVD attributes the 8.8 score to Microsoft as the CVE Numbering Authority. The NVD record is marked Undergoing Enrichment and contains no separate NIST assessment.
Exploitation status
Microsoft's assessment at original publication:
- Publicly disclosed: No
- Exploited: No
- Exploitation Less Likely
The Qualys November 2026 Patch Tuesday review does not identify an actor, campaign, proof of concept or named detection rule for this CVE.
Cisco Talos describes CVE-2026-120788 as an Excel remote code execution issue involving a heap buffer overflow, and places it in the group Microsoft considers less likely to be exploited. Its article announces Snort rules for some vulnerabilities in the release, but it does not map a rule specifically to this CVE.
All of these are assessments made at release time. They do not guarantee that exploitation cannot occur later, or that it has not occurred undetected.
Patch information
Microsoft fixed CVE-2026-120788 on November 10, 2026 as part of that month's Patch Tuesday. The temporal Remediation Level is RL:O (Official Fix), meaning a complete vendor fix exists and not just a workaround. The full vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
What the fix changes
Microsoft has not said which parsing routine was fixed, and there is no public diff. Fixes for CWE-122 bugs usually take one of two forms:
- adding bounds or length checks before data from the file is copied into a heap buffer
- correcting the size calculation used when the buffer is allocated, so record contents can no longer write past the end
This is our inference about the bug class. Microsoft has not confirmed which approach it used. The only reliable remediation is moving to the patched builds below, and Microsoft publishes no separate workaround for this vulnerability.
Fixed builds by product
The MSRC advisory and NVD's CNA data list these fixed versions. Any build below them is vulnerable.
- Microsoft 365 Apps for Enterprise (32 bit and 64 bit): the fixed build depends on the update channel. See Office Security Releases and the Microsoft 365 Apps security update release notes. Delivered as a Click to Run channel update.
- Microsoft Office LTSC 2024 (32 bit and 64 bit):
16.0.17932.21140, via Click to Run. - Microsoft Office LTSC 2021 (32 bit and 64 bit):
16.0.14334.21048, via Click to Run. - Microsoft Office 365 for Mac:
16.115.26110837. See the Office for Mac release notes. - Office LTSC for Mac 2021 and 2024:
16.115.26110837, via the Office for Mac update. - Office Online Server:
16.0.10417.20236, via KB5002946.
Do not apply a single Office build across different product families.
Office Online Server: KB5002946
Office Online Server is the only affected product that receives a separate MSI-style package with its own KB article. KB5002946 is a large cumulative Excel rollup. Alongside CVE-2026-120788, it covers dozens of other Excel remote code execution and information disclosure CVEs from the same release, including CVE-2026-120785, CVE-2026-120786, CVE-2026-120789 and CVE-2026-120790. The fix for this bug cannot be installed on its own.
Details from the KB:
- Package build:
16.0.10417.20236. The release version of Office Online Server must already be installed. - Replaces: KB5002928.
- Package file and SHA256: listed below. Verify the hash if you download the file outside Microsoft Update.
- Where to get it: Microsoft Update, the Microsoft Update Catalog, or the Download Center. Microsoft also publishes a CSV listing the files the package contains.
wacserver2019-kb5002946-fullfile-x64-glb.exe SHA256: F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0
Deploying to an Office Online Server farm
The KB lists Microsoft Update as a distribution channel. Microsoft's Office Online Server operational guidance, however, states that applying updates through automatic updating is unsupported. Incorrect automatic installation can leave users unable to view or edit documents and can require the farm to be rebuilt.
Single-server farm. Microsoft documents this sequence:
- Remove the server from the farm.
- Apply the update.
- Restart if prompted.
- Recreate the farm.
Office Online is unavailable for the duration of this process.
Multiple-server farm. Microsoft documents this sequence:
- Remove one server from the load balancer and the farm.
- Update that server.
- Create an updated farm on it.
- Update the remaining servers and join them to the new farm.
Microsoft states that this approach allows document viewing and editing to continue without disruption. In both cases, preserve the farm configuration and add back any configured Excel Online data model servers.
Click to Run and Mac editions
Microsoft 365 Apps, Office LTSC 2021 and 2024, and the Mac editions do not get a separate KB. The fix arrives as a build increment through the normal update channel.
To confirm a system is patched, check the build number:
- Windows: File, then Account.
- Mac: About Excel.
The build should be at or above the fixed build listed above. For Microsoft 365 Apps, the fixed build varies by channel, which is why Microsoft points to the OfficeSecurityReleases page instead of giving a single version number.
Affected systems and versions
The following products are affected at any build below the listed fixed version:
- Microsoft 365 Apps for Enterprise, 32 bit and 64 bit: builds below the channel-specific fixed release published in the Office security release notes.
- Microsoft Office LTSC 2021, 32 bit and 64 bit: builds below
16.0.14334.21048. - Microsoft Office LTSC 2024, 32 bit and 64 bit: builds below
16.0.17932.21140. - Microsoft Office 365 for Mac: builds below
16.115.26110837. - Microsoft Office LTSC for Mac 2021: builds below
16.115.26110837. - Microsoft Office LTSC for Mac 2024: builds below
16.115.26110837. - Office Online Server: builds below
16.0.10417.20236, which includes servers without KB5002946 (for example, those still on KB5002928).
The vulnerable configuration documented by Microsoft is Excel opening a crafted workbook, followed by user interaction with affected workbook features. Preview Pane rendering is not listed as an attack vector.
Vendor security history
The CVE record's vendor field arrived as Unknown. The CNA and responsible vendor is Microsoft Corporation. Microsoft's annual report places Microsoft 365 Commercial and Consumer products within its Productivity and Business Processes segment.
On May 14, 2026, the UK Competition and Markets Authority opened a strategic market status investigation into Microsoft's business software ecosystem. The CMA described Windows, Word, Excel, Teams and increasingly Copilot as software used daily across UK businesses and public sector organizations. The investigation has not reached a final finding, and the CMA's description is not a global market share figure.
On April 2, 2024, the Cyber Safety Review Board released its review of the Summer 2023 Microsoft Exchange Online intrusion. The Board concluded that the intrusion was preventable. It also found that a set of operational and strategic decisions collectively pointed to a corporate culture that deprioritized enterprise security investments and rigorous risk management. Microsoft fully cooperated with the review. That incident is separate from CVE-2026-120788.
Microsoft's July 2026 Secure Future Initiative progress report describes its response:
- security embedded across culture, governance and engineering
- Zero Trust controls applied to platforms, engineering pipelines and governance systems
- security treated as a matter of continuous validation rather than a one-time milestone
These reforms are reported by Microsoft itself. Neither the CSRB findings nor the SFI report says anything about who might exploit this Excel flaw. The concrete remediation path for this CVE remains the product-specific fix.
References
- NVD: CVE-2026-120788
- CVE Record: CVE-2026-120788
- Microsoft Security Update Guide: CVE-2026-120788
- Microsoft Support: Security update for Office Online Server, November 10, 2026 (KB5002946)
- Microsoft Update Catalog: KB5002946
- Microsoft Download Center: KB5002946
- Office Security Releases
- Release notes for Microsoft Office security updates
- Release notes for Office for Mac
- Apply software updates to Office Online Server
- MITRE CWE-122: Heap Based Buffer Overflow
- FIRST CVSS v3.1 Specification Document
- Qualys: Microsoft Patch Tuesday, November 2026 Security Update Review
- Cisco Talos: Microsoft Patch Tuesday for November 2026
- Zero Day Initiative: The November 2026 Security Update Review
- Tenable: Security Updates for Microsoft Office Products (November 2026)
- Cyber Security Agency of Singapore: November 2026 Monthly Patch
- Senserva: CVE-2026-120788 Office Online Server fix KB5002946
- OffSeq Threat Radar: CVE-2026-120788
- DHS: Cyber Safety Review Board Report on Microsoft Online Exchange Incident from Summer 2023
- Microsoft Trust Center: SFI Progress Report July 2026
- Microsoft 2026 Annual Report
- GOV.UK: CMA launches strategic market status investigation into Microsoft's business software ecosystem
