{"id":"CVE-2026-118301","kind":"vulnerability","aliases":["CVE-2026-118301"],"related":[],"title":"Microsoft Excel: uninitialized memory use lets a remote attacker run code","description":"Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Microsoft Office Excel reads a resource before it is initialized, a memory-safety flaw. A remote, unauthenticated attacker could use it to execute code on a victim's machine.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["excel","microsoft-office","other","windows"],"not_affected_if":["office-not-installed"],"how_to_check":"- Open Excel and check the build under File > Account > About Excel, then compare it with Microsoft's advisory for CVE-2026-118301.","fix":null,"status":"open","published_at":"2026-11-10T19:19:43+00:00","first_seen_at":"2026-11-10T19:24:52+00:00","triaged_at":"2026-11-10T19:44:41+00:00","updated_at":"2026-11-10T19:44:41+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T19:44:41Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Microsoft Excel: uninitialized memory use lets a remote attacker run code","impact":"high","summary":"Microsoft Office Excel reads a resource before it is initialized, a memory-safety flaw. A remote, unauthenticated attacker could use it to execute code on a victim's machine.","audience":"everyone","category":"other","nicknames":[],"who_cares":["excel","microsoft-office","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the machine over the network","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-118301 for affected builds, the fixed build and whether user interaction is required.","how_to_check":"- Open Excel and check the build under File > Account > About Excel, then compare it with Microsoft's advisory for CVE-2026-118301.\n- unknown","plain_action":"Update Microsoft Excel through Microsoft Update once Microsoft publishes the fix for CVE-2026-118301.","product_name":"","needs_analyst":true,"not_affected_if":["office-not-installed"],"who_is_affected":"Organisations and people running Microsoft Office Excel are exposed, most likely when they open a crafted file or document. The sources do not name the affected builds or the exact trigger. Teams that do not run Office can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000709,"input_tokens":4494,"output_tokens":520,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-118301 for affected builds, the fixed build and whether user interaction is required.","search":"'-118301':14A,17A '-2026':13A,16A 'allow':62C 'attack':9A,42B,65C 'code':11A,48B,68C 'could':43B 'cve':12A,15A 'excel':2A,18B,26B,61C 'execut':47B,67C 'flaw':38B 'initi':33B 'let':6A 'machin':53B 'memori':4A,36B 'memory-safeti':35B 'microsoft':1A,20B,24B,59C 'microsoft-offic':19B 'network':71C 'offic':21B,25B,60C 'read':27B 'remot':8A,40B 'resourc':29B,57C 'run':10A 'safeti':37B 'unauthent':41B 'unauthor':64C 'uniniti':3A,56C 'use':5A,44B,54C 'victim':51B 'window':23B","nicknames":[],"mitigations":[],"who_affected":"Organisations and people running Microsoft Office Excel are exposed, most likely when they open a crafted file or document. The sources do not name the affected builds or the exact trigger. Teams that do not run Office can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Update Microsoft Excel through Microsoft Update once Microsoft publishes the fix for CVE-2026-118301.","pkeys":[],"ptokens":[],"labels":["excel","high","microsoftoffice","other","windows"],"campaign_type":null,"search_a":"'-118301':14A,17A '-2026':13A,16A 'attack':9A 'code':11A 'cve':12A,15A 'excel':2A 'let':6A 'memori':4A 'microsoft':1A 'remot':8A 'run':10A 'uniniti':3A 'use':5A","search_b":"'attack':42B 'code':48B 'could':43B 'excel':18B,26B 'execut':47B 'flaw':38B 'initi':33B 'machin':53B 'memori':36B 'memory-safeti':35B 'microsoft':20B,24B 'microsoft-offic':19B 'offic':21B,25B 'read':27B 'remot':40B 'resourc':29B 'safeti':37B 'unauthent':41B 'use':44B 'victim':51B 'window':23B","search_c":"'allow':62C 'attack':65C 'code':68C 'excel':61C 'execut':67C 'microsoft':59C 'network':71C 'offic':60C 'resourc':57C 'unauthor':64C 'uniniti':56C 'use':54C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118301","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118301","severity":null,"published_at":"2026-11-10T19:19:43+00:00","modified_at":"2026-11-10T19:19:43+00:00","first_seen_at":"2026-11-10T19:24:52+00:00","fetched_at":"2026-11-10T19:24:52+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}