{"id":"CVE-2026-118297","kind":"vulnerability","aliases":["CVE-2026-118297"],"related":[],"title":"Microsoft Excel: heap buffer overflow lets attackers run code over network","description":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in Microsoft Excel lets an unauthorized attacker execute code remotely over a network. The sources give no further detail on the trigger or the affected versions.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Office Excel","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Microsoft 365 Apps for Enterprise","fixed":["Current Channel 2610 20527.20196"],"affected":">= 16.0.1, below the Nov 10 2026 channel build","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2021","fixed":["16.0.14334.21048"],"affected":">= 16.0.1, < 16.0.14334.21048","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2024","fixed":["16.0.17932.21140"],"affected":">= 16.0.0, < 16.0.17932.21140","ecosystem":"vendor"},{"name":"Microsoft Office for Mac","fixed":["16.115.26110837"],"affected":"< 16.115.26110837","ecosystem":"vendor"},{"name":"Microsoft Office Online Server","fixed":["16.0.10417.20236"],"affected":">= 16.0.0.0, < 16.0.10417.20236","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["excel","macos","microsoft-office","other","user-interaction","windows"],"not_affected_if":[],"how_to_check":"In Excel, go to File > Account > About Excel and compare the build with the fixed builds in the fix field. For Mac, use Excel > About Excel. Fleet: check the Microsoft 365 Apps channel build against https://aka.ms/OfficeSecurityReleases.","fix":"Install the November 10, 2026 Office update. Microsoft 365 Apps: Current Channel 2610 build 20527.20196 or the matching channel build listed at aka.ms/OfficeSecurityReleases. Office LTSC 2021: 16.0.14334.21048 or later. Office LTSC 2024: 16.0.17932.21140 or later. Office for Mac and LTSC for Mac 2021/2024: 16.115.26110837 or later. Office Online Server: 16.0.10417.20236 or later.","status":"open","published_at":"2026-11-10T19:19:43+00:00","first_seen_at":"2026-11-10T19:24:52+00:00","triaged_at":"2026-11-10T19:29:54+00:00","updated_at":"2026-11-10T23:12:45+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T19:29:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Excel: heap buffer overflow lets attackers run code over network","impact":"high","summary":"A heap-based buffer overflow in Microsoft Excel lets an unauthorized attacker execute code remotely over a network. The sources give no further detail on the trigger or the affected versions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["microsoft-office","excel","windows"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the affected Excel user's machine.","analyst_note":"Check the Microsoft Security Response Center advisory for affected builds, fixed versions, and whether user interaction (opening a file) is needed.","how_to_check":"- unknown","plain_action":"","product_name":"Microsoft Office Excel","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000646,"input_tokens":4496,"output_tokens":393,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center advisory for affected builds, fixed versions, and whether user interaction (opening a file) is needed.","search":"'-118297':14A,17A '-2026':13A,16A '2021':29A '2024':33A '365':22A 'affect':82B 'allow':93C 'apps':23A 'attack':7A,64B,96C 'base':55B,86C 'buffer':4A,56B,87C 'code':9A,66B,99C 'cve':12A,15A 'detail':76B 'enterprise':25A 'excel':2A,20A,42B,60B,92C 'execut':65B,98C 'for':24A,36A 'give':73B 'heap':3A,54B,85C 'heap-bas':53B,84C 'interact':50B 'let':6A,61B 'ltsc':28A,32A 'mac':37A 'maco':43B 'microsoft':1A,18A,21A,26A,30A,34A,38A,45B,59B,90C 'microsoft-offic':44B 'network':11A,70B,102C 'offic':46B,91C 'office':19A,27A,31A,35A,39A 'online':40A 'overflow':5A,57B,88C 'remot':67B 'run':8A 'server':41A 'sourc':72B 'trigger':79B 'unauthor':63B,95C 'user':49B 'user-interact':48B 'version':83B 'window':51B","nicknames":[],"mitigations":[],"who_affected":"Anyone running desktop Excel from Microsoft 365 Apps, Office LTSC 2021 or 2024 (Windows or Mac), or Office Online Server below the fixed builds. The CVSS vector is network with user interaction required, so the realistic path is a victim opening a crafted workbook. Teams that do not run Excel, or are already on the November 2026 builds, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["365appsforenterprise","microsoft365appsforenterprise","microsoftofficeexcel","microsoftofficeformac","microsoftofficeltsc2021","microsoftofficeltsc2024","microsoftofficeonlineserver","officeexcel","officeformac","officeltsc2021","officeltsc2024","officeonlineserver"],"ptokens":["2021","2024","365","apps","enterprise","excel","for","ltsc","mac","microsoft","office","online","server"],"labels":["excel","high","macos","microsoftoffice","other","userinteraction","vendor","windows"],"campaign_type":null,"search_a":"'-118297':14A,17A '-2026':13A,16A '2021':29A '2024':33A '365':22A 'apps':23A 'attack':7A 'buffer':4A 'code':9A 'cve':12A,15A 'enterprise':25A 'excel':2A,20A 'for':24A,36A 'heap':3A 'let':6A 'ltsc':28A,32A 'mac':37A 'microsoft':1A,18A,21A,26A,30A,34A,38A 'network':11A 'office':19A,27A,31A,35A,39A 'online':40A 'overflow':5A 'run':8A 'server':41A","search_b":"'affect':82B 'attack':64B 'base':55B 'buffer':56B 'code':66B 'detail':76B 'excel':42B,60B 'execut':65B 'give':73B 'heap':54B 'heap-bas':53B 'interact':50B 'let':61B 'maco':43B 'microsoft':45B,59B 'microsoft-offic':44B 'network':70B 'offic':46B 'overflow':57B 'remot':67B 'sourc':72B 'trigger':79B 'unauthor':63B 'user':49B 'user-interact':48B 'version':83B 'window':51B","search_c":"'allow':93C 'attack':96C 'base':86C 'buffer':87C 'code':99C 'excel':92C 'execut':98C 'heap':85C 'heap-bas':84C 'microsoft':90C 'network':102C 'offic':91C 'overflow':88C 'unauthor':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118297","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118297","severity":null,"published_at":"2026-11-10T19:19:43+00:00","modified_at":"2026-11-10T19:19:43+00:00","first_seen_at":"2026-11-10T19:24:52+00:00","fetched_at":"2026-11-10T19:24:52+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118297:3122","url":"https://app.opencve.io/cve/CVE-2026-118297","severity":null,"published_at":"2026-11-10T23:12:45+00:00","modified_at":"2026-11-10T23:12:45+00:00","first_seen_at":"2026-11-10T23:12:45+00:00","fetched_at":"2026-11-10T23:12:45+00:00","note":"MSRC page is JS-only and not readable; affected ranges taken from Microsoft CNA data mirrored on OpenCVE/NVD (not verified against MSRC). Fix build from Learn release notes snippet. No exploitation found; ZDI Nov 2026 lists only an Outlook bug as exploited.","cites":["https://app.opencve.io/cve/CVE-2026-118297","https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates"]}],"documents":[{"id":120075,"url":"https://app.opencve.io/cve/CVE-2026-118297","title":"OpenCVE: CVE-2026-118297 (mirrors Microsoft CNA affected list)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":118854,"url":"https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","title":"Microsoft Office security updates release notes (Nov 10, 2026)","kind":"vendor","source":"analyst","publisher":null,"text":"November 10, 2026: Current Channel 2610 (20527.20196); MEC 2610 (20527.20194), 2609 (20430.20264), 2608 (20326.20320); SAEC 2610 (20527.20192), 2609 (20430.20262), 2608 (20326.20318); Office 2024/2021 Retail 2610 (20527.20196); LTSC 2024 2408 (17932.21140); LTSC 2021 2108 (14334.21048); Office 2019 1808 (10417.20236). CVE-2026-118301 listed under Excel.","published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}