{"id":"CVE-2026-118292","kind":"vulnerability","aliases":["CVE-2026-118292"],"related":[],"title":"Microsoft Excel: stack buffer overflow lets attackers run code over network","description":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Stack-based buffer overflow (CWE-121) in Microsoft Office Excel, fixed in Microsoft's November 2026 updates. An attacker can get code execution; the CVSS vector (AV:N/UI:R) means a user must open a crafted file. No exploitation or public PoC found.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft 365 Apps for Enterprise","fixed":[],"affected":">= 16.0.1, < build per channel (aka.ms/OfficeSecurityReleases)","ecosystem":"vendor"},{"name":"Office LTSC 2021","fixed":["16.0.14334.21048"],"affected":">= 16.0.1, < 16.0.14334.21048","ecosystem":"vendor"},{"name":"Office LTSC 2024","fixed":["16.0.17932.21140"],"affected":">= 16.0.0, < 16.0.17932.21140","ecosystem":"vendor"},{"name":"Office for Mac (365, LTSC 2021, LTSC 2024)","fixed":["16.115.26110837"],"affected":"< 16.115.26110837","ecosystem":"vendor"},{"name":"Office Online Server","fixed":["16.0.10417.20236"],"affected":">= 16.0.0.0, < 16.0.10417.20236","ecosystem":"vendor"}],"ecosystems":[],"tags":["excel","macos","microsoft-office","office-online-server","other","windows"],"not_affected_if":[],"how_to_check":"Check Excel build: File > Account > About Excel. Affected if below: LTSC 2021 16.0.14334.21048, LTSC 2024 16.0.17932.21140, Office for Mac / LTSC Mac 2021 and 2024 16.115.26110837, Office Online Server 16.0.10417.20236. For Microsoft 365 Apps see https://aka.ms/OfficeSecurityReleases for the fixed build per channel. Builds from Microsoft's CNA record via OpenCVE; confirm on MSRC.","fix":"Install the November 2026 Office security updates: LTSC 2021 16.0.14334.21048, LTSC 2024 16.0.17932.21140, Mac 16.115.26110837, Office Online Server 16.0.10417.20236, Microsoft 365 Apps per channel build on aka.ms/OfficeSecurityReleases.","status":"open","published_at":"2026-11-10T19:19:42+00:00","first_seen_at":"2026-11-10T19:24:51+00:00","triaged_at":"2026-11-10T19:29:58+00:00","updated_at":"2026-11-10T23:13:38+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T19:29:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Excel: stack buffer overflow lets attackers run code over network","impact":"high","summary":"A stack-based buffer overflow in Microsoft Office Excel lets an unauthorized attacker run code on a machine over a network. The sources give no further detail on the trigger or affected versions.","audience":"everyone","category":"other","nicknames":[],"who_cares":["microsoft-office","excel","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the machine over the network","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-118292 for affected versions, patch and whether a user must open a file.","how_to_check":"- unknown","plain_action":"Update Microsoft Excel through Microsoft's standard update channel once a patch is released for your version.","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Any machine running an affected version of Microsoft Office Excel may be exposed; the sources do not list affected versions or the exact attack path. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000664,"input_tokens":4496,"output_tokens":429,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-118292 for affected versions, patch and whether a user must open a file.","search":"'-118292':14A,17A '-121':57B '-2026':13A,16A '2021':25A,34A '2024':28A,36A '2026':67B '365':19A,32A 'allow':104C 'apps':20A 'attack':7A,70B,107C 'av':78B 'base':53B,97C 'buffer':4A,54B,98C 'code':9A,73B,110C 'craft':87B 'cve':12A,15A 'cvss':76B 'cwe':56B 'enterprise':22A 'excel':2A,40B,61B,103C 'execut':74B,109C 'exploit':90B 'file':88B 'fix':62B 'for':21A,30A 'found':94B 'get':72B 'let':6A 'ltsc':24A,27A,33A,35A 'mac':31A 'maco':41B 'mean':81B 'microsoft':1A,18A,43B,59B,64B,101C 'microsoft-offic':42B 'must':84B 'n/ui':79B 'network':11A,113C 'novemb':66B 'offic':44B,46B,60B,102C 'office':23A,26A,29A,37A 'office-online-serv':45B 'onlin':47B 'online':38A 'open':85B 'overflow':5A,55B,99C 'poc':93B 'public':92B 'r':80B 'run':8A 'server':39A,48B 'stack':3A,52B,96C 'stack-bas':51B,95C 'unauthor':106C 'updat':68B 'user':83B 'vector':77B 'window':50B","nicknames":[],"mitigations":[],"who_affected":"Anyone running desktop Excel from Microsoft 365 Apps, Office LTSC 2021/2024 (Windows) or Office for Mac, or Office Online Server, below the fixed builds. Exploitation needs a user to open a crafted file. Fully patched installs can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Microsoft Excel: open any Office app, choose File > Account > Update Options > Update Now (on Mac: Help > Check for Updates).","pkeys":["365appsforenterprise","formac365ltsc2021ltsc2024","ltsc2021","ltsc2024","microsoft365appsforenterprise","officeformac365ltsc2021ltsc2024","officeltsc2021","officeltsc2024","officeonlineserver","onlineserver"],"ptokens":["2021","2024","365","apps","enterprise","for","ltsc","mac","microsoft","office","online","server"],"labels":["excel","high","macos","microsoftoffice","officeonlineserver","other","windows"],"campaign_type":null,"search_a":"'-118292':14A,17A '-2026':13A,16A '2021':25A,34A '2024':28A,36A '365':19A,32A 'apps':20A 'attack':7A 'buffer':4A 'code':9A 'cve':12A,15A 'enterprise':22A 'excel':2A 'for':21A,30A 'let':6A 'ltsc':24A,27A,33A,35A 'mac':31A 'microsoft':1A,18A 'network':11A 'office':23A,26A,29A,37A 'online':38A 'overflow':5A 'run':8A 'server':39A 'stack':3A","search_b":"'-121':57B '2026':67B 'attack':70B 'av':78B 'base':53B 'buffer':54B 'code':73B 'craft':87B 'cvss':76B 'cwe':56B 'excel':40B,61B 'execut':74B 'exploit':90B 'file':88B 'fix':62B 'found':94B 'get':72B 'maco':41B 'mean':81B 'microsoft':43B,59B,64B 'microsoft-offic':42B 'must':84B 'n/ui':79B 'novemb':66B 'offic':44B,46B,60B 'office-online-serv':45B 'onlin':47B 'open':85B 'overflow':55B 'poc':93B 'public':92B 'r':80B 'server':48B 'stack':52B 'stack-bas':51B 'updat':68B 'user':83B 'vector':77B 'window':50B","search_c":"'allow':104C 'attack':107C 'base':97C 'buffer':98C 'code':110C 'excel':103C 'execut':109C 'microsoft':101C 'network':113C 'offic':102C 'overflow':99C 'stack':96C 'stack-bas':95C 'unauthor':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118292","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118292","severity":null,"published_at":"2026-11-10T19:19:42+00:00","modified_at":"2026-11-10T19:19:42+00:00","first_seen_at":"2026-11-10T19:24:51+00:00","fetched_at":"2026-11-10T19:24:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118292:3127","url":"https://app.opencve.io/cve/CVE-2026-118292","severity":null,"published_at":"2026-11-10T23:13:38+00:00","modified_at":"2026-11-10T23:13:38+00:00","first_seen_at":"2026-11-10T23:13:38+00:00","fetched_at":"2026-11-10T23:13:38+00:00","note":"MSRC page is JS-only and unreadable here; versions come from Microsoft's CNA record via OpenCVE (secondary). Nothing verified. Vector UI:R, so a user must open a crafted file. Not exploited per ZDI Nov 2026 excerpt (only an Outlook CVE is). Revisit when MSRC text is readable.","cites":["https://app.opencve.io/cve/CVE-2026-118292"]}],"documents":[{"id":120085,"url":"https://app.opencve.io/cve/CVE-2026-118292","title":"OpenCVE: CVE-2026-118292 (mirror of Microsoft CNA data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}