{"id":"CVE-2026-118298","kind":"vulnerability","aliases":["CVE-2026-118298"],"related":[],"title":"Microsoft Excel: heap buffer overflow lets a network attacker run code","description":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel (CWE-122) lets an unauthorized attacker run code. Microsoft rates it 8.8 (CVSS vector AV:N/UI:R): the user must open a crafted file, and exploitation is not reported. Fixed in the November 10, 2026 Office updates.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Office Excel","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2024","fixed":["16.0.17932.21140"],"affected":"< 16.0.17932.21140","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2021","fixed":["16.0.14334.21048"],"affected":"< 16.0.14334.21048","ecosystem":"vendor"},{"name":"Office Online Server","fixed":["16.0.10417.20236"],"affected":"< 16.0.10417.20236","ecosystem":"vendor"},{"name":"Microsoft Office for Mac (365/LTSC 2021/2024)","fixed":["16.115.26110837"],"affected":"< 16.115.26110837","ecosystem":"vendor"},{"name":"Microsoft 365 Apps for Enterprise","fixed":["2610 20527.20196"],"affected":"< Nov 10 2026 build (e.g. CC 2610 20527.20196)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["excel","macos","microsoft-office","package","user-interaction","windows"],"not_affected_if":["patched-nov-2026"],"how_to_check":"In Excel open File > Account > About Excel and compare the build with the fixed builds. Microsoft 365 Apps/Office 2024/2021 Retail Current Channel: 2610 build 20527.20196 or later. LTSC 2024: 16.0.17932.21140. LTSC 2021: 16.0.14334.21048. Office 2019 volume: 10417.20236. Office for Mac: 16.115.26110837. Office Online Server: 16.0.10417.20236. Other channel builds: https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","fix":"Install the November 10, 2026 Office security update (Microsoft 365 Apps via Update Now; LTSC 2024 17932.21140; LTSC 2021 14334.21048; Mac 16.115.26110837; Office Online Server 16.0.10417.20236).","status":"open","published_at":"2026-11-10T19:19:43+00:00","first_seen_at":"2026-11-10T19:24:52+00:00","triaged_at":"2026-11-10T19:29:53+00:00","updated_at":"2026-11-10T23:12:57+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T19:29:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Excel: heap buffer overflow lets a network attacker run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft Office Excel lets an unauthorized attacker run code over a network. The sources give no further detail on the trigger or affected versions.","audience":"everyone","category":"package","nicknames":[],"who_cares":["microsoft-office","excel","windows"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the machine over the network","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-118298 for affected versions, fixed builds and whether user interaction (opening a file) is required.","how_to_check":"- unknown","plain_action":"Update Microsoft Excel through Microsoft's Office update channel once Microsoft releases a fix.","product_name":"Microsoft Office Excel","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00066,"input_tokens":4496,"output_tokens":420,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-118298 for affected versions, fixed builds and whether user interaction (opening a file) is required.","search":"'-118298':14A,17A '-122':63B '-2026':13A,16A '10':95B '2021':28A '2021/2024':37A '2024':24A '2026':96B '365':39A '365/ltsc':36A '8.8':73B 'allow':108C 'apps':40A 'attack':9A,67B,111C 'av':76B 'base':55B,101C 'buffer':4A,56B,102C 'code':11A,69B,114C 'craft':84B 'cve':12A,15A 'cvss':74B 'cwe':62B 'enterprise':42A 'excel':2A,20A,43B,61B,107C 'execut':113C 'exploit':87B 'file':85B 'fix':91B 'for':34A,41A 'heap':3A,54B,100C 'heap-bas':53B,99C 'interact':51B 'let':6A,64B 'ltsc':23A,27A 'mac':35A 'maco':44B 'microsoft':1A,18A,21A,25A,32A,38A,46B,59B,70B,105C 'microsoft-offic':45B 'must':81B 'n/ui':77B 'network':8A,117C 'novemb':94B 'offic':47B,60B,97B,106C 'office':19A,22A,26A,29A,33A 'online':30A 'open':82B 'overflow':5A,57B,103C 'packag':48B 'r':78B 'rate':71B 'report':90B 'run':10A,68B 'server':31A 'unauthor':66B,110C 'updat':98B 'user':50B,80B 'user-interact':49B 'vector':75B 'window':52B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Excel from Microsoft 365 Apps, Office 2021/2024 (including LTSC), Office for Mac, or Office Online Server at a build older than the November 2026 update. An attacker has to get a user to open a malicious workbook, so desktop users who receive files by email or download are the main exposure.","tier":"B","verified":{"fix":{"at":"2026-11-10T23:12:57Z","by":"analyst","doc":"https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","run_id":3121}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":"Update Microsoft Excel through Microsoft's Office update channel once Microsoft releases a fix.","pkeys":["365appsforenterprise","microsoft365appsforenterprise","microsoftofficeexcel","microsoftofficeformac365ltsc20212024","microsoftofficeltsc2021","microsoftofficeltsc2024","officeexcel","officeformac365ltsc20212024","officeltsc2021","officeltsc2024","officeonlineserver","onlineserver"],"ptokens":["2021","2024","365","apps","enterprise","excel","for","ltsc","mac","microsoft","office","online","server"],"labels":["excel","high","macos","microsoftoffice","package","userinteraction","vendor","windows"],"campaign_type":null,"search_a":"'-118298':14A,17A '-2026':13A,16A '2021':28A '2021/2024':37A '2024':24A '365':39A '365/ltsc':36A 'apps':40A 'attack':9A 'buffer':4A 'code':11A 'cve':12A,15A 'enterprise':42A 'excel':2A,20A 'for':34A,41A 'heap':3A 'let':6A 'ltsc':23A,27A 'mac':35A 'microsoft':1A,18A,21A,25A,32A,38A 'network':8A 'office':19A,22A,26A,29A,33A 'online':30A 'overflow':5A 'run':10A 'server':31A","search_b":"'-122':63B '10':95B '2026':96B '8.8':73B 'attack':67B 'av':76B 'base':55B 'buffer':56B 'code':69B 'craft':84B 'cvss':74B 'cwe':62B 'excel':43B,61B 'exploit':87B 'file':85B 'fix':91B 'heap':54B 'heap-bas':53B 'interact':51B 'let':64B 'maco':44B 'microsoft':46B,59B,70B 'microsoft-offic':45B 'must':81B 'n/ui':77B 'novemb':94B 'offic':47B,60B,97B 'open':82B 'overflow':57B 'packag':48B 'r':78B 'rate':71B 'report':90B 'run':68B 'unauthor':66B 'updat':98B 'user':50B,80B 'user-interact':49B 'vector':75B 'window':52B","search_c":"'allow':108C 'attack':111C 'base':101C 'buffer':102C 'code':114C 'excel':107C 'execut':113C 'heap':100C 'heap-bas':99C 'microsoft':105C 'network':117C 'offic':106C 'overflow':103C 'unauthor':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118298","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118298","severity":null,"published_at":"2026-11-10T19:19:43+00:00","modified_at":"2026-11-10T19:19:43+00:00","first_seen_at":"2026-11-10T19:24:52+00:00","fetched_at":"2026-11-10T19:24:52+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118298:3121","url":"https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","severity":null,"published_at":"2026-11-10T23:12:57+00:00","modified_at":"2026-11-10T23:12:57+00:00","first_seen_at":"2026-11-10T23:12:57+00:00","fetched_at":"2026-11-10T23:12:57+00:00","note":"MSRC page unreadable via tools; fix builds from Microsoft Learn Office release notes (Nov 10 2026 lists CVE under Excel); affected ranges and CVSS from OpenCVE mirror of Microsoft CNA data, not verified. No exploitation or PoC seen.","cites":["https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","https://app.opencve.io/cve/CVE-2026-118298"]}],"documents":[{"id":118854,"url":"https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","title":"Microsoft Office security updates release notes (Nov 10, 2026)","kind":"vendor","source":"analyst","publisher":null,"text":"November 10, 2026: Current Channel 2610 (20527.20196); MEC 2610 (20527.20194), 2609 (20430.20264), 2608 (20326.20320); SAEC 2610 (20527.20192), 2609 (20430.20262), 2608 (20326.20318); Office 2024/2021 Retail 2610 (20527.20196); LTSC 2024 2408 (17932.21140); LTSC 2021 2108 (14334.21048); Office 2019 1808 (10417.20236). CVE-2026-118301 listed under Excel.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":120080,"url":"https://app.opencve.io/cve/CVE-2026-118298","title":"OpenCVE: CVE-2026-118298 (mirrors Microsoft CNA data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}