Brief Summary: Microsoft Excel CVE-2026-118714 Heap-Based Buffer Overflow Leading to Remote Code Execution

Introduction

Microsoft's November 10, 2026 Patch Tuesday release fixes a heap-based buffer overflow in Excel that can lead to code execution when a user opens a specially crafted file. The affected product list spans Microsoft 365 Apps for Enterprise, Office LTSC on Windows and Mac, and Office Online Server, so remediation touches both desktop fleets and server infrastructure.

Microsoft scores CVE-2026-118714 at CVSS v3.1 8.8 (shown as High in NVD) and separately assigns it an Important severity rating. At publication, Microsoft recorded the issue as not publicly disclosed, Exploited: No, and Exploitation Less Likely. ZDI's November review and a separate vulnerability tracker agree: no known exploitation, no public exploit code, and no threat actor or campaign tied to this CVE in the sources we reviewed.

Technical information

Root cause

Microsoft identifies the weakness as CWE 122, heap-based buffer overflow, in Microsoft Office Excel. MITRE defines CWE 122 as a condition where data is written past the end of a buffer allocated on the heap. This is a memory corruption bug, not a malicious macro or abuse of a documented spreadsheet feature.

MITRE notes that heap overflows can cause crashes and may enable arbitrary code execution, including through corruption of function pointers. Those are general consequences of the weakness class. Microsoft has not said which technique, if any, applies to CVE-2026-118714.

Excel is closed source, so there is no public commit, diff, or vulnerable code snippet. Microsoft has not disclosed:

• the vulnerable function
• the file format or record involved
• the corruption offset
• how reliably the bug can be exploited
• the privilege level an attacker gets after code execution

CVSS characteristics

Microsoft supplies the following base vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector: Network. The attack starts from a remote context.
• Attack Complexity: Low.
• Privileges Required: None. The attacker needs no prior authorization. This describes the attacker's starting point, not the privileges gained after execution.
• User Interaction: Required. A user has to open the file.
• Scope: Unchanged.
• Confidentiality, Integrity, Availability: High for each.

The temporal score is 7.7. The temporal vector includes RL:O (Remediation Level: Official Fix), which MSRC defines as "A complete vendor solution is available." NVD lists Microsoft as the scoring source and states that its own assessment is not yet provided, so 8.8 is the vendor's score, not an independent NIST rescoring.

The network attack vector should not be read on its own. Combined with required user interaction, it describes a crafted-file scenario rather than an exposed listening service that can be exploited automatically.

Attack flow

Based on Microsoft's documented scenario:

1. The attacker creates a specially crafted file designed to trigger the heap overflow in Excel's handling of the file. The advisory does not say which structure inside the file is malformed.
2. The attacker gets the file to the target user. The advisory does not specify a delivery channel.
3. The user opens the file in an affected Excel build. The advisory names opening the file as the trigger and does not describe any additional step, such as saving it.
4. While Excel processes the file, data is written past the end of a heap buffer. Microsoft states this can result in remote code execution.

Microsoft explicitly states that the Preview Pane is not an attack vector for this CVE.

Patch information

What the advisory says about the fix

Microsoft fixed CVE-2026-118714 in its November 10, 2026 Patch Tuesday release, and the MSRC advisory marks it as an Official Fix. Microsoft has not described the code change.

As background only, heap overflow fixes in a file parser like Excel's usually add or correct a length or bounds check before data from the file is copied into a heap buffer. This is not a confirmed account of this particular patch.

Fixed builds by product

These come from the MSRC Security Updates table:

• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): Click to Run channel builds (listed below)
• Office LTSC 2024 (32 bit and 64 bit): 16.0.17932.21140
• Office LTSC 2021 (32 bit and 64 bit): 16.0.14334.21048
• Office LTSC for Mac 2021, Office LTSC for Mac 2024, Office 365 for Mac: 16.115.26110837
• Office Online Server: 16.0.10417.20236 (KB5002946)

Click to Run channel builds

The Office security release notes list CVE-2026-118714 under Excel for November 10, 2026. The fixed builds are:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: 2610 (20527.20194), 2609 (20430.20264), 2608 (20326.20320)
• Semi Annual Enterprise Channel: 2610 (20527.20192), 2609 (20430.20262), 2608 (20326.20318)
• Office 2024 and 2021 Retail: Version 2610 (Build 20527.20196)

The same release notes entry also lists an Office 2019 Volume Licensed build (10417.20236). Office 2019 does not appear in the MSRC product table for this CVE, so we do not treat that build as confirmed coverage for this bug.

Office Online Server: KB5002946

Office Online Server renders workbooks on the server, so it is the one product where this Excel bug runs on a server instead of a desktop. It gets its own package, KB5002946 (build 16.0.10417.20236). The KB says it fixes an Excel remote code execution bug and an Excel information disclosure bug, and it lists CVE-2026-118714 among roughly 60 Excel and Office CVEs.

• It replaces the October package, KB5002928. You need the November build to get this fix.
• It requires the release version of Office Online Server to be installed.
• It is available through Microsoft Update, the Microsoft Update Catalog, and the Microsoft Download Center. Hosts with automatic updating can download and install it automatically.
• Microsoft publishes a CSV listing every file the update changes.
• The KB does not specify a restart requirement or a farm maintenance sequence, so we do not suggest one here.

Before deploying, check the downloaded package against the published SHA256 hash:

File:   wacserver2019-kb5002946-fullfile-x64-glb.exe
SHA256: F22404A759DF1160F0A45B867ADA579CCB33515D807F0AC216E478052AA299E0

KB5002946 covers the server only. It does not patch the other Office products.

Deployment paths

• Windows: Where the update controls are available, open an Office application, create a document, and select File > Account > Update Options > Update Now. Select Enable Updates first if needed. If Update Options is missing, Microsoft notes this can mean a volume-licensed installation or Group Policy management.
• Mac: Deploy through Microsoft AutoUpdate, or download updates and push them with software distribution tools. Microsoft states that individual security fixes cannot be installed separately. Updates arrive as a new application bundle.

Why you cannot isolate this fix

Microsoft ships this fix inside cumulative builds that also cover dozens of other Excel CVEs from the same month. ZDI's November review lists about 64 Excel CVEs in this release. If you compare patched and unpatched binaries, you will see many changes and no easy way to tell which one addresses CVE-2026-118714.

For defenders, that makes the build number the only reliable way to confirm the fix. A host at or above the build listed for its product and channel has the patch.

MITRE's prevention guidance for CWE 122 (automatic bounds checking, explicit input bounds checking, safer alternatives to dangerous functions) is general developer advice, not a confirmed workaround for this CVE. No vulnerability-specific workaround is documented, so the official update is the remediation.

Affected systems and versions

NVD records the numeric fixed builds below as upper bounds for affected versions. Builds earlier than the listed version are affected.

• Microsoft Office LTSC 2021 (32 bit and 64 bit): builds earlier than 16.0.14334.21048
• Microsoft Office LTSC 2024 (32 bit and 64 bit): builds earlier than 16.0.17932.21140
• Microsoft Office 365 for Mac: builds earlier than 16.115.26110837
• Microsoft Office LTSC for Mac 2021: builds earlier than 16.115.26110837
• Microsoft Office LTSC for Mac 2024: builds earlier than 16.115.26110837
• Office Online Server: builds earlier than 16.0.10417.20236 (fixed by KB5002946)
• Microsoft 365 Apps for Enterprise (32 bit and 64 bit): the advisory does not give a single numeric build. Instead, it points to the Office security release notes. Hosts below the Click to Run build listed for their channel in the Patch information section are not remediated.

Office 2019 is not listed in the MSRC product table for this CVE.

Vendor security history

The Cyber Safety Review Board describes Microsoft as sitting at the center of the technology ecosystem. That is a statement about Microsoft's systemic importance, not an Excel market share figure.

In its review of the 2023 Exchange Online intrusion, the Board reported that a threat actor compromised mailboxes, including accounts belonging to senior United States government officials. The Board's findings included:

• the intrusion should not have happened and succeeded because of a cascade of Microsoft security failures
• Microsoft's decisions indicated that enterprise security investment and rigorous risk management had been deprioritized
• incomplete information from Microsoft impaired the Commerce Department's assessment during its response

That incident was a separate cloud security event. It has no connection to exploitation of CVE-2026-118714 and gives no basis for attributing this CVE to any actor.

Microsoft's own July 2026 Secure Future Initiative progress report describes improvements:

• engineering defaults now prevent 83% of pipelines from accessing unapproved package endpoints
• Microsoft remediated more than 550,000 critical and high-risk open source vulnerabilities

These are vendor-reported results. Neither the CSRB report nor the SFI report shows that those initiatives prevented this Excel flaw or independently validates its patch.

References

• Microsoft Security Update Guide: CVE-2026-118714
• NVD entry for CVE-2026-118714
• CVE Record for CVE-2026-118714
• Security update for Office Online Server, November 10, 2026 (KB5002946)
• Release notes for Microsoft Office security updates
• Release notes for Microsoft Office security updates (alternate link)
• Zero Day Initiative: The November 2026 Security Update Review (thezdi.com)
• Zero Day Initiative: The November 2026 Security Update Review (zerodayinitiative.com)
• MITRE CWE 122: Heap Based Buffer Overflow
• How to update Microsoft 365 or Office for Windows
• Deploy updates for Office for Mac
• Cisco Talos: Microsoft Patch Tuesday for November 2026
• Qualys: Microsoft Patch Tuesday, November 2026 Security Update Review
• Senserva: CVE-2026-118714 Office Online Server fix KB5002946
• cve.now: CVE-2026-118714
• Microsoft Secure Future Initiative: July 2026 progress report
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion