Microsoft Office Excel: Remote code execution via heap-based buffer overflow
Summary
A heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over the network. Exploitation requires user interaction, typically by opening a malicious workbook received by email or from a file share. Code then runs in the context of the user. Microsoft rates the impact on confidentiality, integrity and availability as high, and CISA SSVC rates the technical impact as total while the vulnerability is not automatable.
Affected
- Microsoft 365 Apps for Enterprise: from 16.0.1 before the fixed build listed at aka.ms/OfficeSecurityReleases
- Office 365 for Mac: from 1.0.0 before 16.115.26110837
- Office LTSC 2021: from 16.0.1 before 16.0.14334.21048
- Office LTSC 2024: from 16.0.0 before 16.0.17932.21140
- Office LTSC for Mac 2021: from 16.0.1 before 16.115.26110837
- Office LTSC for Mac 2024: from 16.0.0 before 16.115.26110837
- Office Online Server: from 16.0.0.0 before 16.0.10417.20236
Fixed in
- Office 365 for Mac: 16.115.26110837
- Office LTSC 2021: 16.0.14334.21048
- Office LTSC 2024: 16.0.17932.21140
- Office LTSC for Mac 2021 and 2024: 16.115.26110837
- Office Online Server: 16.0.10417.20236
- Microsoft 365 Apps for Enterprise: Unknown. The fixed build is not stated in the sources reviewed; check the MSRC advisory.
Workaround
Unknown. No vendor-published workaround was found. Installing the November 2026 Office security updates is the practical measure.
Exploitation
- Exploited in the wild: no evidence found.
- Public exploit: none found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Install the November 2026 Office security updates on all desktop Office installations and on any on-premises Office Online Server.
- Verify the Microsoft 365 Apps build number against the MSRC advisory, as the fixed build is not stated in the CNA record.
- Prioritise users who open external files and keep email attachment filtering and macro policies in place.
- Check whether Office Online Server is in use in your environment.
- Monitor NVD and MSRC for changes in exploitation status.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Microsoft Office Excel
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Microsoft Office
- Updates (KB)
- KB5002946
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-118294 msrc.microsoft.com
- CVE Record CVE-2026-118294 (CNA: Microsoft) www.cve.org
- Microsoft November 2026 Patch Tuesday overview cybersecuritynews.com
- CVE-2026-118294 tracker entry (third party) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 22:07.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.