Microsoft Office Excel: Invalid pointer reference enables remote code execution

Summary

Microsoft Office Excel contains a flaw classified as CWE-763 (release of invalid pointer or reference). An unauthorized attacker can execute code over the network, with high impact on confidentiality, integrity and availability. According to the CVSS vector, a user must take an action, most likely opening a crafted spreadsheet received by email, file share or download. The CVE record attributes the issue to Excel, but a SharePoint blog also lists it among SharePoint on-premises fixes, so the scope is not yet confirmed.

Affected

• Microsoft 365 Apps for Enterprise: 16.0.1 to before the fixed build (exact build unknown, see MSRC)
• Office 365 for Mac: 1.0.0 to before 16.115.26110837
• Office LTSC 2021: 16.0.1 to before 16.0.14334.21048
• Office LTSC 2024: 16.0.0 to before 16.0.17932.21140
• Office LTSC for Mac 2021: 16.0.1 to before 16.115.26110837
• Office LTSC for Mac 2024: 16.0.0 to before 16.115.26110837
• Office Online Server: 16.0.0.0 to before 16.0.10417.20236
• Unverified: possible SharePoint Server on-premises impact, not confirmed by the CVE record

Fixed in

• Microsoft 365 Apps for Enterprise: Unknown, check MSRC
• Office 365 for Mac: 16.115.26110837
• Office LTSC 2021: 16.0.14334.21048
• Office LTSC 2024: 16.0.17932.21140
• Office LTSC for Mac 2021: 16.115.26110837
• Office LTSC for Mac 2024: 16.115.26110837
• Office Online Server: 16.0.10417.20236

Workaround

Unknown. No workaround found in the available sources. Apply the security update.

Exploitation

• No evidence of exploitation in the wild found in the available sources.
• The MSRC exploitation field could not be verified.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• No public proof of concept found; coverage of this recent CVE is limited.

Our recommendation

• Inventory all Office installations (Microsoft 365 channel, LTSC 2021/2024, Mac) and their build numbers.
• Install the security updates and verify the fixed builds against the MSRC table.
• Check whether a SharePoint Server on-premises farm is in use and patch it if so.
• Prioritise users who regularly open external spreadsheets.
• Keep Protected View enabled and treat unsolicited spreadsheets from external senders with caution until patched.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record CVE-2026-118708 (CVE.org) www.cve.org
• Microsoft Security Update Guide CVE-2026-118708 msrc.microsoft.com
• Threatint CVE summary CVE-2026-118708 cve.threatint.com
• Strix CVE summary CVE-2026-118708 www.strix.ai
• SharePoint November 2026 update blog (scope conflict) blog.stefan-gossner.com
• November 2026 Patch Tuesday roundup cybersecuritynews.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:51.