{"id":"CVE-2026-118707","kind":"vulnerability","aliases":["CVE-2026-118707"],"related":[],"title":"Microsoft Excel: heap overflow lets a remote attacker run code","description":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in Microsoft Office Excel lets an unauthorized attacker run code over a network. The sources give no further detail on how the file or request is delivered.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Office LTSC 2024","fixed":["16.0.17932.21140"],"affected":">= 16.0.0, < 16.0.17932.21140","ecosystem":"vendor"},{"name":"Office LTSC 2021","fixed":["16.0.14334.21048"],"affected":">= 16.0.1, < 16.0.14334.21048","ecosystem":"vendor"},{"name":"Office for Mac","fixed":["16.115.26110837"],"affected":"< 16.115.26110837","ecosystem":"vendor"},{"name":"Microsoft 365 Apps for Enterprise","fixed":["Current Channel 2610 build 20527.20196"],"affected":">= 16.0.1, < November 10 2026 build per channel","ecosystem":"vendor"}],"ecosystems":[],"tags":["excel","macos","microsoft-office","other","user-interaction","windows"],"not_affected_if":[],"how_to_check":"In Excel open File > Account > About Excel and compare the build with the fixed builds: LTSC 2024 < 16.0.17932.21140, LTSC 2021 < 16.0.14334.21048, Mac < 16.115.26110837, Microsoft 365 Apps < the November 10 2026 build for your channel (https://aka.ms/OfficeSecurityReleases). Also check Office 2019/2021/2024 retail installs, which the CNA list may include.","fix":"Update Office to the November 10, 2026 security release: Microsoft 365 Apps per https://aka.ms/OfficeSecurityReleases (Current Channel 2610 build 20527.20196); Office LTSC 2024 16.0.17932.21140 or later; Office LTSC 2021 16.0.14334.21048 or later; Office for Mac 16.115.26110837 or later.","status":"open","published_at":"2026-11-10T19:19:45+00:00","first_seen_at":"2026-11-10T19:24:52+00:00","triaged_at":"2026-11-10T19:29:43+00:00","updated_at":"2026-11-10T23:09:31+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-10T19:29:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Excel: heap overflow lets a remote attacker run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft Office Excel lets an unauthorized attacker run code over a network. The sources give no further detail on how the file or request is delivered.","audience":"businesses","category":"other","nicknames":[],"who_cares":["microsoft-office","excel","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the machine over the network","analyst_note":"Find Microsoft's security update guide entry for CVE-2026-118707 to confirm affected builds, the fixed version and whether user interaction (opening a file) is required.","how_to_check":"- Check the installed Excel build under File > Account > About Excel against Microsoft's security update guide for CVE-2026-118707\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organisations running Microsoft Office Excel are the ones exposed. The sources do not say which Excel builds or file paths are involved, so the affected range is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000674,"input_tokens":4496,"output_tokens":449,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Microsoft's security update guide entry for CVE-2026-118707 to confirm affected builds, the fixed version and whether user interaction (opening a file) is required.","search":"'-118707':13A,16A '-2026':12A,15A '2021':22A '2024':19A '365':27A 'allow':83C 'apps':28A 'attack':8A,54B,86C 'base':44B,76C 'buffer':45B,77C 'code':10A,56B,89C 'cve':11A,14A 'deliv':73B 'detail':65B 'enterprise':30A 'excel':2A,31B,50B,82C 'execut':88C 'file':69B 'for':24A,29A 'give':62B 'heap':3A,43B,75C 'heap-bas':42B,74C 'interact':39B 'let':5A,51B 'ltsc':18A,21A 'mac':25A 'maco':32B 'microsoft':1A,26A,34B,48B,80C 'microsoft-offic':33B 'network':59B,92C 'offic':35B,49B,81C 'office':17A,20A,23A 'overflow':4A,46B,78C 'remot':7A 'request':71B 'run':9A,55B 'sourc':61B 'unauthor':53B,85C 'user':38B 'user-interact':37B 'window':40B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Microsoft Excel (Microsoft 365 Apps, Office LTSC 2021/2024, Office for Mac) on a build older than the November 2026 update. Per the CVSS vector an attacker needs a user to open a crafted file, so workstations that open spreadsheets from email or downloads matter most. Machines already on the November 10, 2026 build can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["365appsforenterprise","formac","ltsc2021","ltsc2024","microsoft365appsforenterprise","officeformac","officeltsc2021","officeltsc2024"],"ptokens":["2021","2024","365","apps","enterprise","for","ltsc","mac","microsoft","office"],"labels":["excel","high","macos","microsoftoffice","other","userinteraction","windows"],"campaign_type":null,"search_a":"'-118707':13A,16A '-2026':12A,15A '2021':22A '2024':19A '365':27A 'apps':28A 'attack':8A 'code':10A 'cve':11A,14A 'enterprise':30A 'excel':2A 'for':24A,29A 'heap':3A 'let':5A 'ltsc':18A,21A 'mac':25A 'microsoft':1A,26A 'office':17A,20A,23A 'overflow':4A 'remot':7A 'run':9A","search_b":"'attack':54B 'base':44B 'buffer':45B 'code':56B 'deliv':73B 'detail':65B 'excel':31B,50B 'file':69B 'give':62B 'heap':43B 'heap-bas':42B 'interact':39B 'let':51B 'maco':32B 'microsoft':34B,48B 'microsoft-offic':33B 'network':59B 'offic':35B,49B 'overflow':46B 'request':71B 'run':55B 'sourc':61B 'unauthor':53B 'user':38B 'user-interact':37B 'window':40B","search_c":"'allow':83C 'attack':86C 'base':76C 'buffer':77C 'code':89C 'excel':82C 'execut':88C 'heap':75C 'heap-bas':74C 'microsoft':80C 'network':92C 'offic':81C 'overflow':78C 'unauthor':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118707","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118707","severity":null,"published_at":"2026-11-10T19:19:45+00:00","modified_at":"2026-11-10T19:19:46+00:00","first_seen_at":"2026-11-10T19:24:52+00:00","fetched_at":"2026-11-10T19:24:52+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118707:3110","url":"https://nvd.nist.gov/vuln/detail/cve-2026-118707","severity":null,"published_at":"2026-11-10T23:09:31+00:00","modified_at":"2026-11-10T23:09:31+00:00","first_seen_at":"2026-11-10T23:09:31+00:00","fetched_at":"2026-11-10T23:09:31+00:00","note":"MSRC page is JS-only, not read. Product/fixed builds from Microsoft's CNA record (via NVD mirror); Nov 10 2026 Office release notes on Learn list the builds. CVSS vector UI:R: needs a user to open a crafted file. Not exploited per sources. Nothing marked verified (MSRC entry not read).","cites":["https://nvd.nist.gov/vuln/detail/cve-2026-118707","https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates"]}],"documents":[{"id":120058,"url":"https://nvd.nist.gov/vuln/detail/cve-2026-118707","title":"NVD CVE-2026-118707 (CNA data from Microsoft)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":118854,"url":"https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","title":"Release notes for Microsoft Office security updates (Nov 10, 2026 lists CVE-2026-113759 under Word)","kind":"advisory","source":"analyst","publisher":null,"text":"November 10, 2026: Current Channel 2610 (20527.20196); MEC 2610 (20527.20194), 2609 (20430.20264), 2608 (20326.20320); SAEC 2610 (20527.20192), 2609 (20430.20262), 2608 (20326.20318); Office 2024/2021 Retail 2610 (20527.20196); LTSC 2024 2408 (17932.21140); LTSC 2021 2108 (14334.21048); Office 2019 1808 (10417.20236). CVE-2026-118301 listed under Excel.","published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}