Microsoft Office Excel: Remote Code Execution via heap-based buffer overflow

Summary

A heap-based buffer overflow in Microsoft Office Excel allows remote code execution. An attacker can run code in the context of the user if a victim opens a crafted file, for example a spreadsheet received by email or via Teams. Microsoft rates the CVSS score at 8.8 (High), and the CNA record affects Microsoft 365 Apps, Office LTSC 2021 and 2024, Office for Mac and Office Online Server.

Affected

• Microsoft 365 Apps for Enterprise: 16.0.1 up to the fixed build (exact build: Unknown, see Microsoft advisory)
• Microsoft Office 365 for Mac: 1.0.0 before 16.115.26110837
• Microsoft Office LTSC 2021: 16.0.1 before 16.0.14334.21048
• Microsoft Office LTSC 2024: 16.0.0 before 16.0.17932.21140 (third-party source, not confirmed by Microsoft)
• Microsoft Office LTSC for Mac 2021 and 2024: before 16.115.26110837 (third-party source for 2021 and 2024 builds, not confirmed by Microsoft)
• Microsoft Office Online Server: 16.0.0.0 before 16.0.10417.20236 (third-party source, not confirmed by Microsoft)

Fixed in

• Microsoft 365 Apps: Unknown build; see Office security release page https://aka.ms/OfficeSecurityReleases
• Office 365 for Mac and LTSC for Mac: 16.115.26110837 or later
• Office LTSC 2021: 16.0.14334.21048 or later
• Office LTSC 2024 and Office Online Server: builds listed above are from a third-party source and need confirmation on the MSRC page

Workaround

• Vendor-published workaround: Unknown.
• Generic measures, not from the advisory: keep Protected View and macro restrictions enabled and filter spreadsheet attachments from untrusted senders at the mail gateway until patched.

Exploitation

• No in-the-wild exploitation found at publication.
• No public proof of concept found.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• Microsoft temporal vector E:U (exploit code maturity Unproven), RL:O, RC:C.
• Not verified as listed in the CISA KEV catalog at the time of writing.

Our recommendation

• Read the Microsoft advisory and install the fixed builds for every deployed Office product.
• If SharePoint or Office Online Server is used, check the farm patch level and folder permissions before installing the update.
• Keep macros and Protected View restrictions in place and filter spreadsheet attachments at the mail gateway until patched.
• Patch together with the other Excel memory-corruption CVEs published on the same day.
• Check the CISA KEV catalog and NVD again over the next few days, as the status may change.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide msrc.microsoft.com
• CVE.org CNA record www.cve.org
• VulDB CVE-2026-118726 entry vuldb.com
• Strix CVE-2026-118726 (third-party) www.strix.ai
• SharePoint November 2026 PU fixes (third-party blog) blog.stefan-gossner.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:45.