Microsoft Office Excel: Remote Code Execution vulnerability
Summary
A heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. Exploitation requires that a user opens a crafted Excel file, for example one received by email or downloaded from the internet. Successful exploitation would run code with the rights of the logged-in user. Microsoft rates the flaw with a CVSS score of 8.8 (High), and no in-the-wild exploitation or public exploit is known as of publication.
Affected
- Microsoft 365 Apps for Enterprise: 16.0.1 to before the fixed build (exact build unknown)
- Microsoft Office 365 for Mac: 1.0.0 to before 16.115.26110837
- Microsoft Office LTSC 2021: 16.0.1 to before 16.0.14334.21048
- Microsoft Office LTSC 2024: 16.0.0 to before 16.0.17932.21140 (unverified)
- Microsoft Office LTSC for Mac 2021 and 2024: before 16.115.26110837 (unverified)
- Microsoft Office Online Server: 16.0.0.0 to before 16.0.10417.20236 (unverified)
Fixed in
- Microsoft 365 Apps for Enterprise: Unknown. Verify on the MSRC advisory.
- Microsoft Office 365 for Mac: 16.115.26110837
- Microsoft Office LTSC 2021: 16.0.14334.21048
- Microsoft Office LTSC 2024: 16.0.17932.21140 (unverified)
- Microsoft Office Online Server: 16.0.10417.20236 (unverified)
Workaround
Unknown. No workaround or mitigation is documented in the sources reviewed.
- Until patched, keep Protected View and macro restrictions enabled.
- Be cautious with spreadsheets received by email or downloaded from the internet.
Exploitation
- No confirmed exploitation in the wild.
- No public exploit is known (VulDB).
- Not listed in CISA KEV at the time of analysis (third-party tracker; not verified against the CISA catalog).
Our recommendation
- Deploy the November 2026 Office security updates to all clients and confirm the installed build numbers.
- Read the MSRC advisory and record the exact fixed build for each channel.
- Check whether SharePoint Server or Office Online Server is deployed and affected.
- Remind users not to open unexpected Excel attachments, and monitor for changes in KEV and exploit status.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Microsoft Office Excel
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Microsoft Office
- Updates (KB)
- KB5002946
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-118707 msrc.microsoft.com
- CVE Record CVE-2026-118707 (CVE Program) www.cve.org
- VulDB entry 434115 vuldb.com
- Strix CVE overview CVE-2026-118707 www.strix.ai
- CVE-2026-118707 CWE and vulnerability details (threatint) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:57.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.