Microsoft Office Excel: Remote code execution via heap-based buffer overflow

Summary

A heap-based buffer overflow in Microsoft Excel, part of Microsoft 365 Apps, LTSC Office releases and Office for Mac, allows an unauthorized attacker to execute code on a vulnerable system over a network. Exploitation requires a user to open a malicious Excel file, which is typically delivered by email or file sharing. Microsoft has not reported exploitation in the wild for this CVE, and the CVSS base score is 7.5 with high attack complexity.

Affected

• Microsoft 365 Apps for Enterprise: 16.0.1 up to the fixed build (exact fixed build unknown)
• Office 365 for Mac: 1.0.0 before 16.115.26110837
• Office LTSC 2021: 16.0.1 before 16.0.14334.21048
• Office LTSC 2024: 16.0.0 before 16.0.17932.21140 (unverified)
• Office LTSC for Mac 2021: 16.0.1 before 16.115.26110837
• Office LTSC for Mac 2024: 16.0.0 before 16.115.26110837
• Office Online Server: 16.0.0.0 before 16.0.10417.20236
• Other Office versions: unknown, check the MSRC table

Fixed in

• Apply the November 2026 Office security updates for the affected builds listed above.
• Microsoft 365 Apps fixed build: unknown, see https://aka.ms/OfficeSecurityReleases and the MSRC table.
• The Windows cumulative update alone does not fix this issue.

Workaround

• No vendor-documented workaround known.
• Generic interim measure: block or sandbox untrusted Excel files from email and downloads, and restrict external content and macros for files from unknown senders.

Exploitation

• Microsoft's exploitability assessment is E:U (unproven); no exploitation reported.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• No public proof-of-concept known.
• Whether the Preview Pane is an attack vector is unknown.

Our recommendation

• Apply the November 2026 Office security updates to Microsoft 365 Apps, LTSC 2021 and LTSC 2024, and verify the build against the MSRC table.
• Inventory Office builds across endpoints, including Mac.
• Until patched, block or sandbox Excel files from untrusted senders and restrict macros and external content.
• Prioritise staff who handle external files and check mail and file gateways.
• Recheck the MSRC page and NVD for changes in exploitation status or fixed builds.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-124170 msrc.microsoft.com
• CVE.org CVE Record CVE-2026-124170 www.cve.org
• Strix: CVE-2026-124170 www.strix.ai
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• NT Compatible: Microsoft November 2026 Patch Tuesday www.ntcompatible.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:16.