---
id: "CVE-2026-118301"
page: "https://infrastack.ai/live/CVE-2026-118301"
kind: "vulnerability"
aliases: ["CVE-2026-118301"]
title: "Microsoft Excel: uninitialized memory use lets a remote attacker run code"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Microsoft Office LTSC 2021", "fixed": ["16.0.14334.21048"], "affected": "< 16.0.14334.21048", "ecosystem": "vendor"}, {"name": "Microsoft Office LTSC 2024", "fixed": ["16.0.17932.21140"], "affected": "< 16.0.17932.21140", "ecosystem": "vendor"}]
ecosystems: []
tags: ["excel", "macos", "microsoft-office", "other", "windows"]
not_affected_if: ["office-not-installed"]
published_at: "2026-11-10T19:19:43+00:00"
first_seen_at: "2026-11-10T19:24:52+00:00"
updated_at: "2026-11-10T23:11:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118301", "first_seen_at": "2026-11-10T19:24:52+00:00"}, {"source": "analyst", "url": "https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates", "first_seen_at": "2026-11-10T23:11:26+00:00", "cites": ["https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates"]}]
exploit_sources: []
---

# Microsoft Excel: uninitialized memory use lets a remote attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-118301 (this .md is for agents)

Microsoft Office Excel reads a resource before it is initialized, a memory-safety flaw. A remote, unauthenticated attacker could use it to execute code on a victim's machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Office LTSC 2021 affected < 16.0.14334.21048 fixed 16.0.14334.21048
- vendor:Microsoft Office LTSC 2024 affected < 16.0.17932.21140 fixed 16.0.17932.21140

## How to check

In Excel open File > Account > About Excel and compare the version/build with the fixed builds for your channel (Microsoft Office security release notes, Nov 10 2026). Also check Office for Mac (fixed 16.115.26110837). Per Microsoft's CVSS the attack needs user interaction (opening a crafted file).

## Fix

Install the November 10, 2026 Office update: Current Channel 2610 build 20527.20196 or later; Monthly Enterprise 2610 20527.20194 / 2609 20430.20264 / 2608 20326.20320; Office LTSC 2024 17932.21140; LTSC 2021 14334.21048; Office 2019 10417.20236; Office for Mac 16.115.26110837.

## Timeline

- 2026-11-10T19:24:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118301
- 2026-11-10T23:11:26+00:00 analyst https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates — MSRC page not renderable; fixed builds from Microsoft's Nov 10 2026 Office release notes (CVE listed under Excel); product ranges from CNA record via aggregators (secondary). No exploitation or PoC reported. X/search not run.

## Documents

- [fix] Microsoft Office security updates release notes (Nov 10, 2026) https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates

## From the sources

Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_