{"id":"CVE-2026-118717","kind":"vulnerability","aliases":["CVE-2026-118717"],"related":[],"title":"Microsoft Excel: stack buffer overflow lets a network attacker run code","description":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"A stack-based buffer overflow in Microsoft Office Excel lets an unauthorized attacker run code over a network. The sources give no further detail on the trigger or the affected versions.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Office Excel","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Microsoft 365 Apps for Enterprise","fixed":["2610 20527.20196"],"affected":">= 16.0.1, < builds of 10 Nov 2026 (Current Channel 2610 20527.20196)","ecosystem":"vendor"},{"name":"Office LTSC 2024","fixed":["16.0.17932.21140"],"affected":"< 16.0.17932.21140","ecosystem":"vendor"},{"name":"Office LTSC 2021","fixed":["16.0.14334.21048"],"affected":"< 16.0.14334.21048","ecosystem":"vendor"},{"name":"Office for Mac / LTSC for Mac 2021 and 2024","fixed":["16.115.26110837"],"affected":"< 16.115.26110837","ecosystem":"vendor"},{"name":"Office Online Server","fixed":["16.0.10417.20236"],"affected":"< 16.0.10417.20236","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["excel","file-open","macos","microsoft-office","office-online-server","package","windows"],"not_affected_if":["patched-build"],"how_to_check":"In Excel open File > Account > About Excel (Mac: Excel > About Excel) and compare the build with the fixed builds in the fix field. Admins: check the Office update channel and build via the Microsoft 365 admin center or 'Office\\root\\Client\\officec2rclient.exe' version. Exposure needs the user to open a crafted workbook (CVSS UI:R).","fix":"Install the 10 Nov 2026 Office security update. Microsoft 365 Apps/Office 2021/2024 Retail: Current Channel 2610 build 20527.20196 or later (Monthly Enterprise 2610: 20527.20194, 2609: 20430.20264, 2608: 20326.20320). Office LTSC 2024: 16.0.17932.21140. Office LTSC 2021: 16.0.14334.21048. Office 2019 volume: 16.0.10417.20236. Office for Mac / LTSC Mac 2021 and 2024: 16.115.26110837.","status":"open","published_at":"2026-11-10T19:19:47+00:00","first_seen_at":"2026-11-10T19:24:53+00:00","triaged_at":"2026-11-10T19:28:22+00:00","updated_at":"2026-11-10T23:06:33+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T19:28:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Excel: stack buffer overflow lets a network attacker run code","impact":"high","summary":"A stack-based buffer overflow in Microsoft Office Excel lets an unauthorized attacker run code over a network. The sources give no further detail on the trigger or the affected versions.","audience":"everyone","category":"package","nicknames":[],"who_cares":["microsoft-office","excel","windows"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker runs code on the victim's machine over the network","analyst_note":"Confirm affected Excel builds, whether a file must be opened, and the Microsoft advisory's fixed builds at https://nvd.nist.gov/vuln/detail/CVE-2026-118717","how_to_check":"- Check the installed Excel version in File > Account > About Excel\n- unknown","plain_action":"Update Microsoft Excel through Microsoft Update once the vendor's fix is available.","product_name":"Microsoft Office Excel","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000676,"input_tokens":4496,"output_tokens":453,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Excel builds, whether a file must be opened, and the Microsoft advisory's fixed builds at https://nvd.nist.gov/vuln/detail/CVE-2026-118717","search":"'-118717':14A,17A '-2026':13A,16A '2021':31A,38A '2024':28A,40A '365':22A 'affect':88B 'allow':99C 'and':39A 'apps':23A 'attack':9A,71B,102C 'base':61B,92C 'buffer':4A,62B,93C 'code':11A,73B,105C 'cve':12A,15A 'detail':82B 'enterprise':25A 'excel':2A,20A,44B,67B,98C 'execut':104C 'file':46B 'file-open':45B 'for':24A,33A,36A 'give':79B 'let':6A,68B 'ltsc':27A,30A,35A 'mac':34A,37A 'maco':48B 'microsoft':1A,18A,21A,50B,65B,96C 'microsoft-offic':49B 'network':8A,76B,108C 'offic':51B,53B,66B,97C 'office':19A,26A,29A,32A,41A 'office-online-serv':52B 'onlin':54B 'online':42A 'open':47B 'overflow':5A,63B,94C 'packag':56B 'run':10A,72B 'server':43A,55B 'sourc':78B 'stack':3A,60B,91C 'stack-bas':59B,90C 'trigger':85B 'unauthor':70B,101C 'version':89B 'window':57B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Excel from Microsoft 365 Apps, Office LTSC 2021/2024, Office 2019 volume, Office for Mac or Office Online Server below the 10 Nov 2026 fixed builds. Per the CVSS vector the attack is delivered over a network and needs a user to open a crafted file; Microsoft's page we could read does not say whether the Preview Pane is a vector. Systems with Excel fully updated can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T23:06:33Z","by":"analyst","doc":"https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","run_id":3100}},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Microsoft Office (Excel) to the latest version: open any Office app, go to File > Account > Update Options > Update Now. On a Mac, use Help > Check for Updates.","pkeys":["365appsforenterprise","formacltscformac2021and2024","ltsc2021","ltsc2024","microsoft365appsforenterprise","microsoftofficeexcel","officeexcel","officeformacltscformac2021and2024","officeltsc2021","officeltsc2024","officeonlineserver","onlineserver"],"ptokens":["2021","2024","365","and","apps","enterprise","excel","for","ltsc","mac","microsoft","office","online","server"],"labels":["excel","fileopen","high","macos","microsoftoffice","officeonlineserver","package","vendor","windows"],"campaign_type":null,"search_a":"'-118717':14A,17A '-2026':13A,16A '2021':31A,38A '2024':28A,40A '365':22A 'and':39A 'apps':23A 'attack':9A 'buffer':4A 'code':11A 'cve':12A,15A 'enterprise':25A 'excel':2A,20A 'for':24A,33A,36A 'let':6A 'ltsc':27A,30A,35A 'mac':34A,37A 'microsoft':1A,18A,21A 'network':8A 'office':19A,26A,29A,32A,41A 'online':42A 'overflow':5A 'run':10A 'server':43A 'stack':3A","search_b":"'affect':88B 'attack':71B 'base':61B 'buffer':62B 'code':73B 'detail':82B 'excel':44B,67B 'file':46B 'file-open':45B 'give':79B 'let':68B 'maco':48B 'microsoft':50B,65B 'microsoft-offic':49B 'network':76B 'offic':51B,53B,66B 'office-online-serv':52B 'onlin':54B 'open':47B 'overflow':63B 'packag':56B 'run':72B 'server':55B 'sourc':78B 'stack':60B 'stack-bas':59B 'trigger':85B 'unauthor':70B 'version':89B 'window':57B","search_c":"'allow':99C 'attack':102C 'base':92C 'buffer':93C 'code':105C 'excel':98C 'execut':104C 'microsoft':96C 'network':108C 'offic':97C 'overflow':94C 'stack':91C 'stack-bas':90C 'unauthor':101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118717","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118717","severity":null,"published_at":"2026-11-10T19:19:47+00:00","modified_at":"2026-11-10T19:19:47+00:00","first_seen_at":"2026-11-10T19:24:53+00:00","fetched_at":"2026-11-10T19:24:53+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118717:3100","url":"https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","severity":null,"published_at":"2026-11-10T23:06:33+00:00","modified_at":"2026-11-10T23:06:33+00:00","first_seen_at":"2026-11-10T23:06:33+00:00","fetched_at":"2026-11-10T23:06:33+00:00","note":"Fix builds confirmed on Microsoft Learn Office security release notes (Nov 10, 2026 lists this CVE under Excel). Affected ranges come from the CNA record via OpenCVE (a rewrite), unverified. MSRC page and NVD returned no text. No exploitation or PoC reported. Mac and Online Server fixed builds not seen on Microsoft's own page.","cites":["https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","https://app.opencve.io/cve/CVE-2026-118717"]}],"documents":[{"id":118905,"url":"https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","title":"Release notes for Microsoft Office security updates (Nov 10, 2026)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":120027,"url":"https://app.opencve.io/cve/CVE-2026-118717","title":"OpenCVE: CVE-2026-118717 (CNA record from Microsoft)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}