Microsoft Office Excel: Stack-based buffer overflow enables remote code execution

Summary

A stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. Exploitation requires a user to open a crafted file, for example an email attachment or download, and no privileges are needed. The CVE record gives CVSS 8.8, and NVD analysis was still pending at publication. Research notes also link this CVE to SharePoint Server on-premises in the November 2026 update, which conflicts with the Excel attribution and must be verified.

Affected

• Microsoft 365 Apps for Enterprise: 16.0.1 up to the fixed build
• Office 365 for Mac: 1.0.0 before 16.115.26110837
• Office LTSC 2021: 16.0.1 before 16.0.14334.21048
• Office LTSC 2024: 16.0.0 before the fixed build (version unknown)
• Office LTSC for Mac 2021 and 2024: 16.0.1 and 16.0.0 before 16.115.26110837
• Office Online Server: 16.0.0.0 before 16.0.10417.20236

Fixed in

• Office LTSC 2021: 16.0.14334.21048 or later
• Office 365 for Mac: 16.115.26110837 or later
• Microsoft 365 Apps for Enterprise: check the Office security releases page (aka.ms/OfficeSecurityReleases); the CNA record does not state the fixed build
• Office LTSC 2024, LTSC for Mac and Office Online Server: unknown from primary data; check the MSRC entry

Workaround

Unknown. No vendor-published workaround was found.

• General measures, not from the vendor: keep Protected View and macro restrictions enabled; block or quarantine unsolicited spreadsheet attachments and downloads.

Exploitation

• No evidence of in-the-wild exploitation or a public proof of concept was found at the time of research.
• CVSS temporal exploit maturity is Unproven (E:U).
• CISA Known Exploited Vulnerabilities status not confirmed.

Our recommendation

• Apply the Microsoft 365 or Office update as soon as it is available and verify the installed build.
• Check the MSRC Update Guide entry to confirm the affected products and fixed builds.
• If SharePoint Server on-premises is in use, verify whether this CVE applies and check the folder permission prerequisite before patching.
• Block or quarantine unsolicited spreadsheet attachments and monitor NVD and CISA KEV for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide entry msrc.microsoft.com
• CVE Record (CVE.org) www.cve.org
• Stefan Gossner blog: SharePoint November 2026 PU fixes blog.stefan-gossner.com
• Strix CVE-2026-118700 (third-party, unverified) www.strix.ai
• ThreatInt CVE-2026-118700 (third-party, unverified) cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:58.