Microsoft Office Excel: Remote Code Execution via heap-based buffer overflow

Summary

A heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network, with a CVSS score of 8.8. Exploitation requires a user to open a manipulated spreadsheet, for example one received by email or downloaded from the internet. Microsoft rates the impact as high for confidentiality, integrity and availability, and no exploitation in the wild is known.

Affected

• Microsoft 365 Apps for Enterprise: 16.0.1 up to the fixed build (exact build unknown, see Microsoft Security Update Guide)
• Microsoft Office 365 for Mac: before 16.115.26110837
• Microsoft Office LTSC 2021: before 16.0.14334.21048
• Microsoft Office LTSC 2024: before 16.0.17932.21140
• Microsoft Office LTSC for Mac 2021 and 2024: before 16.115.26110837
• Microsoft Office Online Server: before 16.0.10417.20236 (to be confirmed against MSRC)

Fixed in

• November 2026 Office updates (KB 5134569, as cited by a third-party source; confirm against MSRC)
• Office Online Server update (KB 5002946, as cited by a third-party source; confirm against MSRC)
• Fixed builds are listed as the versions above; exact fixed build for Microsoft 365 Apps is unknown.

Workaround

• Unknown. No workaround is documented in the sources reviewed.
• Until patched: do not open Excel files from untrusted email or downloads, and keep Protected View enabled.

Exploitation

• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• No evidence of exploitation in the wild and no public proof of concept found at the time of research.
• The CVSS vector carries exploit code maturity E:U (unproven).
• NVD analysis was still pending at the time of research.

Our recommendation

• Patch all Microsoft 365 Apps, Office LTSC and Office for Mac clients in the November 2026 update cycle.
• Treat Office Online Server and SharePoint farms as higher priority, and check whether they are exposed to the internet.
• Before installing SharePoint fixes on farms still on the September 2025 CU, follow the folder-permission script guidance from the vendor blog.
• Verify the fixed build numbers in the MSRC Security Update Guide before rollout.
• Watch NVD and vendor sources for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE.org CNA record www.cve.org
• Microsoft Security Update Guide msrc.microsoft.com
• Threatint CVE details cve.threatint.com
• Strix CVE details www.strix.ai
• Stefan Gossner: SharePoint security fixes with November 2026 PU blog.stefan-gossner.com
• Cybersecurity News: Microsoft November 2026 Patch Tuesday cybersecuritynews.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:48.