Microsoft Office Excel: Use-after-free allows remote code execution

Summary

Microsoft Office Excel contains a use-after-free memory flaw (CWE-416) that allows an unauthorized attacker to execute code over a network. According to the CNA record, exploitation requires a user to open a crafted file (UI:R), for example an email attachment or a file from a shared drive. The record was published on 2026-11-10, and NVD status was still Awaiting Analysis at the time of research.

Affected

• Microsoft 365 Apps for Enterprise: from 16.0.1, before the build listed on https://aka.ms/OfficeSecurityReleases
• Office 365 for Mac: from 1.0.0, before 16.115.26110837
• Office LTSC 2021: from 16.0.1, before 16.0.14334.21048
• Office LTSC 2024: from 16.0.0, fixed build unconfirmed
• Office LTSC for Mac 2021 and 2024: before 16.115.26110837
• Office Online Server: from 16.0.0.0, before 16.0.10417.20236 (verify on MSRC)

Fixed in

• Office LTSC 2021: 16.0.14334.21048 (per CNA record)
• Office 365 for Mac and LTSC for Mac: 16.115.26110837 (per CNA record)
• Microsoft 365 Apps: build listed on https://aka.ms/OfficeSecurityReleases (exact build not stated)
• Office LTSC 2024: unconfirmed (record cut off; a secondary source lists 16.0.17932.21140)
• Released in Microsoft's November 2026 update cycle. Whether SharePoint is also affected is unconfirmed; verify on MSRC.

Workaround

• No vendor workaround found. Status: unknown.

Exploitation

• No evidence of in-the-wild exploitation found. CISA SSVC lists exploitation as none.
• No public proof of concept found. CVSS exploit maturity is E:U (Unproven).
• A secondary source lists the CVE as not in CISA KEV. The record is new, so recheck CISA KEV and MSRC.

Our recommendation

• Install the November 2026 Microsoft updates on all Microsoft 365 Apps, Office LTSC and Office for Mac clients, and verify the build numbers against MSRC.
• Confirm that SharePoint-related fixes are deployed where SharePoint is in use.
• Until patched, block or quarantine Excel files from untrusted senders, keep Protected View enabled, and restrict macros and external content.
• Check whether Office Online Server is deployed and internet-facing, and monitor for new exploitation reports.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-118732 msrc.microsoft.com
• CVE Record: CVE-2026-118732 www.cve.org
• Stefan Gossner blog: November 2026 SharePoint security fixes blog.stefan-gossner.com
• Strix: CVE-2026-118732 (secondary mirror) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:43.