Microsoft Office Excel: Remote code execution via deserialization of untrusted data

Summary

A deserialization flaw in Microsoft Office Excel allows code execution on the affected system. The CNA record describes the attack as a physical attack, with no privileges required and user interaction needed, which matches a crafted file opened by a user. Microsoft's description and the CVSS vector are unusual and conflict with one third-party report, so the exact attack conditions are not fully confirmed. NVD analysis was still pending at the time of writing.

Affected

• Microsoft 365 Apps for Enterprise (32- and 64-bit), from 16.0.1, before the build listed at https://aka.ms/OfficeSecurityReleases (exact build unknown)
• Microsoft Office 365 for Mac, from 1.0.0 before 16.115.26110837
• Microsoft Office LTSC 2021 (32- and 64-bit), from 16.0.1 before 16.0.14334.21048
• Microsoft Office LTSC for Mac 2021, from 16.0.1 before 16.115.26110837 (per CNA record)
• Microsoft Office LTSC for Mac 2024, from 16.0.0 before 16.115.26110837 (per CNA record)
• Microsoft Office LTSC 2024: listed only by a third-party aggregator (before 16.0.17932.21140), unverified
• Office 2016, 2019 and Office 2021 (non-LTSC): not listed; status unknown

Fixed in

• Install the November 2026 Microsoft 365 / Office security update
• Office LTSC 2021: build 16.0.14334.21048 or later
• Office for Mac: build 16.115.26110837 or later
• Microsoft 365 Apps for Enterprise: build given in the MSRC advisory (not verified)

Workaround

• No workaround documented in the sources reviewed.
• Unknown whether Microsoft publishes a mitigation.

Exploitation

• Rapid7 rates exploitation as less likely; no public disclosure known.
• Microsoft's known in-the-wild exploitation in this release is linked to a different (Outlook) flaw, not this one.
• No public proof of concept known.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Apply the November 2026 Microsoft 365 / Office update on all Excel-equipped systems in the normal monthly cycle.
• Prioritise systems where staff regularly open external or emailed spreadsheets.
• Verify installed Office build numbers against the advisory.
• Consider blocking or sandboxing files from untrusted sources.
• Check the MSRC FAQ to resolve the conflicting attack vector information.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-124229 www.cve.org
• Microsoft Security Update Guide msrc.microsoft.com
• Microsoft 365 Apps security updates learn.microsoft.com
• Strix CVE-2026-124229 (unverified aggregator) www.strix.ai
• Rapid7 Patch Tuesday November 2026 www.rapid7.com
• Cybersecurity News Microsoft November 2026 Patch Tuesday cybersecuritynews.com
• GBHackers Microsoft November 2026 Patch Tuesday gbhackers.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:42.