{"id":"CVE-2026-118711","kind":"vulnerability","aliases":["CVE-2026-118711"],"related":[],"title":"Microsoft Excel: stack buffer overflow lets a network attacker run code","description":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"A stack-based buffer overflow in Microsoft Excel lets an attacker run code. Microsoft rates it CVSS 8.8 (network, no privileges, user interaction required), so a victim most likely has to open a crafted file. Fixed builds are listed by Microsoft in the NVD record.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Office Excel","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2021","fixed":["16.0.14334.21048"],"affected":"16.0.1 - < 16.0.14334.21048","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2024","fixed":["16.0.17932.21140"],"affected":">= 16.0.0, < 16.0.17932.21140","ecosystem":"vendor"},{"name":"Microsoft Office for Mac","fixed":["16.115.26110837"],"affected":"< 16.115.26110837","ecosystem":"vendor"},{"name":"Office Online Server","fixed":["16.0.10417.20236"],"affected":"< 16.0.10417.20236","ecosystem":"vendor"},{"name":"Microsoft 365 Apps for Enterprise","fixed":[],"affected":"16.0.1 up to builds in aka.ms/OfficeSecurityReleases","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["macos","microsoft-excel","microsoft-office","other","user-interaction","windows"],"not_affected_if":[],"how_to_check":"In Excel go to File > Account > About Excel and compare the build with the fixed builds: Office LTSC 2021 16.0.14334.21048, LTSC 2024 16.0.17932.21140, Office for Mac / LTSC for Mac 16.115.26110837, Office Online Server 16.0.10417.20236. For Microsoft 365 Apps see https://aka.ms/OfficeSecurityReleases.","fix":"Update Office to the build in the 'fixed' list for your product: LTSC 2021 16.0.14334.21048, LTSC 2024 16.0.17932.21140, Mac 16.115.26110837, Office Online Server 16.0.10417.20236; Microsoft 365 Apps: current channel build per aka.ms/OfficeSecurityReleases.","status":"open","published_at":"2026-11-10T19:19:46+00:00","first_seen_at":"2026-11-10T19:24:53+00:00","triaged_at":"2026-11-10T19:28:29+00:00","updated_at":"2026-11-10T23:08:23+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T19:28:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Excel: stack buffer overflow lets a network attacker run code","impact":"high","summary":"A stack-based buffer overflow in Microsoft Excel lets an unauthorized attacker run code over a network. The sources give no product versions, fixed builds or trigger details beyond that.","audience":"everyone","category":"other","nicknames":[],"who_cares":["microsoft-excel","microsoft-office"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker runs code on the machine over the network","analyst_note":"Confirm affected Excel and Office builds, the patch from Microsoft's MSRC advisory, and whether user interaction (opening a file) is needed; NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-118711","how_to_check":"- unknown","plain_action":"","product_name":"Microsoft Office Excel","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00066,"input_tokens":4496,"output_tokens":421,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Excel and Office builds, the patch from Microsoft's MSRC advisory, and whether user interaction (opening a file) is needed; NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-118711","search":"'-118711':14A,17A '-2026':13A,16A '2021':24A '2024':28A '365':37A '8.8':71B 'allow':108C 'apps':38A 'attack':9A,64B,111C 'base':56B,101C 'buffer':4A,57B,102C 'build':90B 'code':11A,66B,114C 'craft':87B 'cve':12A,15A 'cvss':70B 'enterprise':40A 'excel':2A,20A,44B,61B,107C 'execut':113C 'file':88B 'fix':89B 'for':31A,39A 'interact':51B,76B 'let':6A,62B 'like':82B 'list':92B 'ltsc':23A,27A 'mac':32A 'maco':41B 'microsoft':1A,18A,21A,25A,29A,36A,43B,46B,60B,67B,94B,105C 'microsoft-excel':42B 'microsoft-offic':45B 'network':8A,72B,117C 'nvd':97B 'offic':47B,106C 'office':19A,22A,26A,30A,33A 'online':34A 'open':85B 'overflow':5A,58B,103C 'privileg':74B 'rate':68B 'record':98B 'requir':77B 'run':10A,65B 'server':35A 'stack':3A,55B,100C 'stack-bas':54B,99C 'unauthor':110C 'user':50B,75B 'user-interact':49B 'victim':80B 'window':52B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Excel from Microsoft 365 Apps, Office LTSC 2021/2024 (Windows or Mac), or Office Online Server below the fixed builds. Exploitation needs user interaction per the CVSS vector, likely opening a malicious workbook. Teams where nobody opens untrusted spreadsheets have lower risk but should still patch.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["365appsforenterprise","microsoft365appsforenterprise","microsoftofficeexcel","microsoftofficeformac","microsoftofficeltsc2021","microsoftofficeltsc2024","officeexcel","officeformac","officeltsc2021","officeltsc2024","officeonlineserver","onlineserver"],"ptokens":["2021","2024","365","apps","enterprise","excel","for","ltsc","mac","microsoft","office","online","server"],"labels":["high","macos","microsoftexcel","microsoftoffice","other","userinteraction","vendor","windows"],"campaign_type":null,"search_a":"'-118711':14A,17A '-2026':13A,16A '2021':24A '2024':28A '365':37A 'apps':38A 'attack':9A 'buffer':4A 'code':11A 'cve':12A,15A 'enterprise':40A 'excel':2A,20A 'for':31A,39A 'let':6A 'ltsc':23A,27A 'mac':32A 'microsoft':1A,18A,21A,25A,29A,36A 'network':8A 'office':19A,22A,26A,30A,33A 'online':34A 'overflow':5A 'run':10A 'server':35A 'stack':3A","search_b":"'8.8':71B 'attack':64B 'base':56B 'buffer':57B 'build':90B 'code':66B 'craft':87B 'cvss':70B 'excel':44B,61B 'file':88B 'fix':89B 'interact':51B,76B 'let':62B 'like':82B 'list':92B 'maco':41B 'microsoft':43B,46B,60B,67B,94B 'microsoft-excel':42B 'microsoft-offic':45B 'network':72B 'nvd':97B 'offic':47B 'open':85B 'overflow':58B 'privileg':74B 'rate':68B 'record':98B 'requir':77B 'run':65B 'stack':55B 'stack-bas':54B 'user':50B,75B 'user-interact':49B 'victim':80B 'window':52B","search_c":"'allow':108C 'attack':111C 'base':101C 'buffer':102C 'code':114C 'excel':107C 'execut':113C 'microsoft':105C 'network':117C 'offic':106C 'overflow':103C 'stack':100C 'stack-bas':99C 'unauthor':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118711","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118711","severity":null,"published_at":"2026-11-10T19:19:46+00:00","modified_at":"2026-11-10T19:19:46+00:00","first_seen_at":"2026-11-10T19:24:53+00:00","fetched_at":"2026-11-10T19:24:53+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118711:3106","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118711","severity":null,"published_at":"2026-11-10T23:08:23+00:00","modified_at":"2026-11-10T23:08:23+00:00","first_seen_at":"2026-11-10T23:08:23+00:00","fetched_at":"2026-11-10T23:08:23+00:00","note":"Read NVD (Microsoft CNA data); MSRC page returned no text via web-cli (JS-only), so nothing marked verified. No exploitation or PoC seen; did not search social.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-118711"]}],"documents":[{"id":120034,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118711","title":"NVD CVE-2026-118711 (CNA data from Microsoft)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}