Microsoft Office Excel: Use-after-free leads to remote code execution

Summary

A use-after-free flaw (CWE-416) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. The attack requires a user to open a crafted spreadsheet, for example one received by email or downloaded from the internet. The CVSS base score is 8.8 (High), and the CVE record describes a network-based attack that requires no privileges.

Affected

• Microsoft 365 Apps for Enterprise (from 16.0.1 up to the build fixed in the Office security release)
• Office LTSC 2021 (from 16.0.1 before 16.0.14334.21048)
• Office LTSC 2024 (from 16.0.0 before 16.0.17932.21140, provisional)
• Office for Mac (from 1.0.0 before 16.115.26110837)
• Office LTSC for Mac 2021 and 2024 (from 16.0.0 or 16.0.1 before 16.115.26110837)
• Office Online Server (from 16.0.0.0 before 16.0.10417.20236, provisional)

Fixed in

• Office for Mac and Office LTSC for Mac: 16.115.26110837 or later
• Office LTSC 2021: 16.0.14334.21048 or later
• Office LTSC 2024: 16.0.17932.21140 or later (secondary source, not yet verified)
• Office Online Server: 16.0.10417.20236 or later (secondary source, not yet verified)
• Microsoft 365 Apps for Enterprise: Unknown. The CVE record does not state the fixed build; check the Microsoft Security Update Guide.

Workaround

Unknown. No workaround is documented in the sources reviewed. Install the Microsoft security update instead.

Exploitation

• No exploitation in the wild is known at the time of research.
• No public proof of concept was found.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• Whether CISA lists this CVE in its Known Exploited Vulnerabilities catalogue is unknown; check it directly.

Our recommendation

• Install the Microsoft Office security update for your channel in the normal monthly cycle, and roll it out faster to staff who open external spreadsheets, such as finance, HR and reception.
• Until patched, keep Protected View enabled, restrict macros and block or sandbox Excel files from email and downloads where practical.
• Inventory the Office versions and channels in use and verify fixed builds against the Microsoft Security Update Guide.
• Monitor for exploitation reports and raise the priority if any appear.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-118706 msrc.microsoft.com
• CVE Record: CVE-2026-118706 www.cve.org
• Strix: CVE-2026-118706 (secondary, verify) www.strix.ai
• ThreatInt: CVE-2026-118706 (secondary, verify) cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:56.