{"id":"CVE-2026-118703","kind":"vulnerability","aliases":["CVE-2026-118703"],"related":[],"title":"Microsoft Excel: use-after-free lets a remote attacker run code","description":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"A use-after-free bug in Microsoft Office Excel lets an unauthorized attacker run code over a network. The attacker gets code execution on the machine that opens the affected file or content.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft 365 Apps for Enterprise","fixed":["Current Channel 2610 20527.20196"],"affected":">= 16.0.1, < build per https://aka.ms/OfficeSecurityReleases","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2024","fixed":["16.0.17932.21140"],"affected":">= 16.0.0, < 16.0.17932.21140","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2021","fixed":["16.0.14334.21048"],"affected":">= 16.0.1, < 16.0.14334.21048","ecosystem":"vendor"},{"name":"Microsoft Office for Mac (365, LTSC 2021, LTSC 2024)","fixed":["16.115.26110837"],"affected":"< 16.115.26110837","ecosystem":"vendor"},{"name":"Office Online Server","fixed":["16.0.10417.20236"],"affected":"< 16.0.10417.20236","ecosystem":"vendor"}],"ecosystems":[],"tags":["excel","macos","microsoft-office","other","windows"],"not_affected_if":["no-desktop-office","patched-builds","unknown"],"how_to_check":"In any Office app open File > Account and read the version/build; you are exposed if it is below the fixed build for your channel (see fix). Managed fleets: query the installed Office ClickToRun version (HKLM\\SOFTWARE\\Microsoft\\Office\\ClickToRun\\Configuration, VersionToReport). On Mac, Excel > About Excel and compare with 16.115.26110837. Also check Office Online Server if you run it (fixed version listed by CNA record: 16.0.10417.20236).","fix":"Install the November 10, 2026 Office updates: Microsoft 365 Apps/Office 2021/2024 Retail Current Channel 2610 build 20527.20196 or later (Monthly Enterprise 2610 20527.20194, 2609 20430.20264, 2608 20326.20320); Office LTSC 2024 16.0.17932.21140; Office LTSC 2021 16.0.14334.21048; Office 2019 volume 16.0.10417.20236; Office for Mac (365, LTSC 2021/2024) 16.115.26110837.","status":"open","published_at":"2026-11-10T19:19:44+00:00","first_seen_at":"2026-11-10T19:24:52+00:00","triaged_at":"2026-11-10T19:29:48+00:00","updated_at":"2026-11-10T23:10:47+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-10T19:29:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Excel: use-after-free lets a remote attacker run code","impact":"high","summary":"A use-after-free bug in Microsoft Office Excel lets an unauthorized attacker run code over a network. The attacker gets code execution on the machine that opens the affected file or content.","audience":"businesses","category":"other","nicknames":[],"who_cares":["excel","microsoft-office","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker runs code on the user's machine over the network","analyst_note":"Confirm affected Excel builds, fixed versions and whether user interaction is required in Microsoft's CVE-2026-118703 advisory; the signal gives no product ranges.","how_to_check":"- Open Excel and check its version under File > Account (or About Excel) and compare with the fixed builds in Microsoft's advisory for CVE-2026-118703\n- Check whether Microsoft 365 or Office update channels are current: unknown if the sources do not say which build is fixed","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organisations running Microsoft Office Excel on Windows or Mac clients are the likely exposure, since the flaw is triggered over a network and needs no account. The sources do not state which Excel builds are affected or whether preview panes or file opening alone are enough. Teams that do not use Excel can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":4482,"output_tokens":548,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Excel builds, fixed versions and whether user interaction is required in Microsoft's CVE-2026-118703 advisory; the signal gives no product ranges.","search":"'-118703':15A,18A '-2026':14A,17A '2021':31A,38A '2024':27A,40A '365':20A,36A 'affect':81B 'allow':92C 'apps':21A 'attack':10A,64B,71B,95C 'bug':56B 'code':12A,66B,73B,98C 'content':84B 'cve':13A,16A 'enterprise':23A 'excel':2A,44B,60B,91C 'execut':74B,97C 'file':82B 'for':22A,34A 'free':6A,55B,87C 'get':72B 'let':7A,61B 'ltsc':26A,30A,37A,39A 'mac':35A 'machin':77B 'maco':45B 'microsoft':1A,19A,24A,28A,32A,47B,58B,89C 'microsoft-offic':46B 'network':69B,101C 'offic':48B,59B,90C 'office':25A,29A,33A,41A 'online':42A 'open':79B 'remot':9A 'run':11A,65B 'server':43A 'unauthor':63B,94C 'use':4A,53B,85C 'use-after-fre':3A,52B 'window':50B","nicknames":[],"mitigations":[],"who_affected":"Anyone running desktop Excel from Microsoft 365 Apps, Office LTSC 2021/2024 or Office for Mac below the November 2026 builds. The CVSS vector (8.8) says user interaction is required: someone has to open a crafted file, so the risk is mainly spreadsheets received by email or downloaded. Excel on the web in Microsoft-hosted services is not listed; teams with no desktop Office can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T23:10:47Z","by":"analyst","doc":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118703","run_id":3114}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["365appsforenterprise","microsoft365appsforenterprise","microsoftofficeformac365ltsc2021ltsc2024","microsoftofficeltsc2021","microsoftofficeltsc2024","officeformac365ltsc2021ltsc2024","officeltsc2021","officeltsc2024","officeonlineserver","onlineserver"],"ptokens":["2021","2024","365","apps","enterprise","for","ltsc","mac","microsoft","office","online","server"],"labels":["excel","high","macos","microsoftoffice","other","windows"],"campaign_type":null,"search_a":"'-118703':15A,18A '-2026':14A,17A '2021':31A,38A '2024':27A,40A '365':20A,36A 'apps':21A 'attack':10A 'code':12A 'cve':13A,16A 'enterprise':23A 'excel':2A 'for':22A,34A 'free':6A 'let':7A 'ltsc':26A,30A,37A,39A 'mac':35A 'microsoft':1A,19A,24A,28A,32A 'office':25A,29A,33A,41A 'online':42A 'remot':9A 'run':11A 'server':43A 'use':4A 'use-after-fre':3A","search_b":"'affect':81B 'attack':64B,71B 'bug':56B 'code':66B,73B 'content':84B 'excel':44B,60B 'execut':74B 'file':82B 'free':55B 'get':72B 'let':61B 'machin':77B 'maco':45B 'microsoft':47B,58B 'microsoft-offic':46B 'network':69B 'offic':48B,59B 'open':79B 'run':65B 'unauthor':63B 'use':53B 'use-after-fre':52B 'window':50B","search_c":"'allow':92C 'attack':95C 'code':98C 'excel':91C 'execut':97C 'free':87C 'microsoft':89C 'network':101C 'offic':90C 'unauthor':94C 'use':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118703","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118703","severity":null,"published_at":"2026-11-10T19:19:44+00:00","modified_at":"2026-11-10T19:19:45+00:00","first_seen_at":"2026-11-10T19:24:52+00:00","fetched_at":"2026-11-10T19:24:52+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118703:3114","url":"https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","severity":null,"published_at":"2026-11-10T23:10:47+00:00","modified_at":"2026-11-10T23:10:47+00:00","first_seen_at":"2026-11-10T23:10:47+00:00","fetched_at":"2026-11-10T23:10:47+00:00","note":"Fix confirmed in Microsoft Learn Office security release notes (Nov 10 2026 lists CVE under Excel). MSRC page is JS-only and unreadable; per-product build numbers come from the Microsoft CNA record via OpenCVE mirror, so products not verified. Not exploited per sources; no KEV; UI required (CVSS 8.8).","cites":["https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","https://app.opencve.io/cve/CVE-2026-118703","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118703"]}],"documents":[{"id":118854,"url":"https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","title":"Microsoft Office security updates release notes (Nov 10, 2026)","kind":"vendor","source":"analyst","publisher":null,"text":"November 10, 2026: Current Channel 2610 (20527.20196); MEC 2610 (20527.20194), 2609 (20430.20264), 2608 (20326.20320); SAEC 2610 (20527.20192), 2609 (20430.20262), 2608 (20326.20318); Office 2024/2021 Retail 2610 (20527.20196); LTSC 2024 2408 (17932.21140); LTSC 2021 2108 (14334.21048); Office 2019 1808 (10417.20236). CVE-2026-118301 listed under Excel.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":120070,"url":"https://app.opencve.io/cve/CVE-2026-118703","title":"OpenCVE: CVE-2026-118703 (mirror of Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":120071,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118703","title":"MSRC: CVE-2026-118703 Microsoft Office Excel Remote Code Execution Vulnerability","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}