---
id: "CVE-2026-118709"
page: "https://infrastack.ai/live/CVE-2026-118709"
kind: "vulnerability"
aliases: ["CVE-2026-118709"]
title: "Microsoft Excel: heap buffer overflow lets remote attacker run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Microsoft Office Excel", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Microsoft Office LTSC 2024", "fixed": ["16.0.17932.21140"], "affected": ">= 16.0.0, < 16.0.17932.21140", "ecosystem": "vendor"}, {"name": "Microsoft Office LTSC 2021", "fixed": ["16.0.14334.21048"], "affected": ">= 16.0.1, < 16.0.14334.21048", "ecosystem": "vendor"}, {"name": "Microsoft Office for Mac", "fixed": ["16.115.26110837"], "affected": "< 16.115.26110837", "ecosystem": "vendor"}, {"name": "Microsoft 365 Apps for Enterprise", "fixed": ["2610 20527.20196"], "affected": ">= 16.0.1, before Nov 10 2026 channel builds", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["excel", "macos", "microsoft-office", "other", "user-interaction", "windows"]
not_affected_if: ["patched-nov-2026-build"]
published_at: "2026-11-10T19:19:46+00:00"
first_seen_at: "2026-11-10T19:24:53+00:00"
updated_at: "2026-11-10T23:09:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118709", "first_seen_at": "2026-11-10T19:24:53+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118709", "first_seen_at": "2026-11-10T23:09:45+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-118709", "https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates"]}]
exploit_sources: []
---

# Microsoft Excel: heap buffer overflow lets remote attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-118709 (this .md is for agents)

Heap-based buffer overflow in Microsoft Office Excel; Microsoft rates it 8.8 (network, no privileges, user interaction required, so a crafted file must be opened). Fixed in the Nov 10 2026 Office updates. No exploitation reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Office Excel affected range not listed fixed no fixed version listed
- vendor:Microsoft Office LTSC 2024 affected >= 16.0.0, < 16.0.17932.21140 fixed 16.0.17932.21140
- vendor:Microsoft Office LTSC 2021 affected >= 16.0.1, < 16.0.14334.21048 fixed 16.0.14334.21048
- vendor:Microsoft Office for Mac affected < 16.115.26110837 fixed 16.115.26110837
- vendor:Microsoft 365 Apps for Enterprise affected >= 16.0.1, before Nov 10 2026 channel builds fixed 2610 20527.20196

## How to check

In Excel: File > Account > About Excel and compare the build with the fixed builds (e.g. LTSC 2024 below 16.0.17932.21140, LTSC 2021 below 16.0.14334.21048, Mac below 16.115.26110837, M365 Apps below the Nov 10 2026 build for your channel). Fleet: see https://aka.ms/OfficeSecurityReleases.

## Fix

Install the Nov 10 2026 Office update: Current Channel 2610 build 20527.20196; Monthly Enterprise 2610 20527.20194 / 2609 20430.20264 / 2608 20326.20320; Office LTSC 2024 16.0.17932.21140; Office LTSC 2021 16.0.14334.21048; Office 2019 10417.20236; Office for Mac 16.115.26110837.

## Timeline

- 2026-11-10T19:24:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118709
- 2026-11-10T23:09:45+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-118709 — Microsoft's Office security release notes list CVE-2026-118709 under Excel for the Nov 10 2026 builds; affected/fixed ranges from Microsoft's CNA record (via NVD). MSRC page is JS-only and not read; UI:R per CNA vector; no exploitation reported.

## Documents

- [advisory] NVD CVE-2026-118709 (Microsoft CNA data) https://nvd.nist.gov/vuln/detail/CVE-2026-118709
- [fix] Microsoft Office security updates release notes (Nov 10, 2026) https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates

## From the sources

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_