Microsoft Office Excel: Stack-based buffer overflow allows remote code execution

Summary

A stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. The attack requires user interaction, typically a victim opening a manipulated spreadsheet received by email or downloaded from the internet. Successful exploitation can give an attacker full control over confidentiality, integrity and availability in the user session.

Affected

• Microsoft 365 Apps for Enterprise (16.0.1 before the release build listed at https://aka.ms/OfficeSecurityReleases)
• Office 365 for Mac (1.0.0 before 16.115.26110837)
• Office LTSC 2021 (16.0.1 before 16.0.14334.21048)
• Office LTSC for Mac 2021 (16.0.1 before 16.115.26110837)
• Office LTSC for Mac 2024 (16.0.0 before 16.115.26110837)
• Office LTSC 2024 (16.0.0 before 16.0.17932.21140, not confirmed in the CVE record excerpt)
• Office Online Server (16.0.0.0 before 16.0.10417.20236, not confirmed in the CVE record excerpt)

Fixed in

• Microsoft 365 Apps for Enterprise: Unknown, check the MSRC advisory
• Office 365 for Mac and Office LTSC for Mac: 16.115.26110837 or later
• Office LTSC 2021: 16.0.14334.21048 or later
• Office LTSC 2024: 16.0.17932.21140 or later (verify on MSRC)
• Office Online Server: 16.0.10417.20236 or later (verify on MSRC)

Workaround

Unknown. Check the MSRC advisory for published mitigations.

• Keep Protected View and macro restrictions enabled.
• Block or quarantine untrusted Excel attachments from email and the internet until patched.

Exploitation

• Exploited in the wild: not reported in the sources reviewed. The CISA KEV catalog was not checked directly.
• Public proof of concept: none found.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• The CVSS temporal vector includes E:U, which indicates no exploit code was known to Microsoft at publication.

Our recommendation

• Install the fixed builds on all Windows and Mac endpoints, and on Office Online Server if deployed, using the builds confirmed on MSRC.
• Ensure Microsoft 365 automatic updates are working and deploy the fix without waiting for the next Patch Tuesday cycle.
• Review email gateway rules for Excel attachments from external senders.
• Check whether Office Online Server is internet-facing and prioritise it.
• Recheck this CVE for KEV listing or public exploit reports in the coming days.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-118720 msrc.microsoft.com
• CVE Record: CVE-2026-118720 www.cve.org
• Strix AI: CVE-2026-118720 www.strix.ai
• ThreatInt: CVE-2026-118720 cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:50.