---
id: "CVE-2026-118722"
page: "https://infrastack.ai/live/CVE-2026-118722"
kind: "vulnerability"
aliases: ["CVE-2026-118722"]
title: "Microsoft Excel: heap buffer overflow lets a remote attacker run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Microsoft 365 Apps for Enterprise", "fixed": [], "affected": ">= 16.0.1, below the fixed build listed at aka.ms/OfficeSecurityReleases", "ecosystem": "vendor"}, {"name": "Microsoft Office LTSC 2021", "fixed": ["16.0.14334.21048"], "affected": ">= 16.0.1, < 16.0.14334.21048", "ecosystem": "vendor"}, {"name": "Microsoft Office LTSC 2024", "fixed": ["16.0.17932.21140"], "affected": ">= 16.0.0, < 16.0.17932.21140", "ecosystem": "vendor"}, {"name": "Microsoft Office 365 for Mac", "fixed": ["16.115.26110837"], "affected": ">= 1.0.0, < 16.115.26110837", "ecosystem": "vendor"}, {"name": "Microsoft Office LTSC for Mac 2021", "fixed": ["16.115.26110837"], "affected": ">= 16.0.1, < 16.115.26110837", "ecosystem": "vendor"}, {"name": "Microsoft Office LTSC for Mac 2024", "fixed": ["16.115.26110837"], "affected": ">= 16.0.0, < 16.115.26110837", "ecosystem": "vendor"}, {"name": "Office Online Server", "fixed": ["16.0.10417.20236"], "affected": ">= 16.0.0.0, < 16.0.10417.20236", "ecosystem": "vendor"}]
ecosystems: []
tags: ["excel", "macos", "microsoft-office", "office-online-server", "other", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:19:48+00:00"
first_seen_at: "2026-11-10T19:24:54+00:00"
updated_at: "2026-11-10T23:02:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118722", "first_seen_at": "2026-11-10T19:24:54+00:00"}, {"source": "analyst", "url": "https://cveawg.mitre.org/api/cve/CVE-2026-118722", "first_seen_at": "2026-11-10T23:02:57+00:00", "cites": ["https://cveawg.mitre.org/api/cve/CVE-2026-118722", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118722"]}]
exploit_sources: []
---

# Microsoft Excel: heap buffer overflow lets a remote attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-118722 (this .md is for agents)

A heap-based buffer overflow in Microsoft Excel lets an unauthorized attacker run code over a network. The sources do not say which file or action triggers it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft 365 Apps for Enterprise affected >= 16.0.1, below the fixed build listed at aka.ms/OfficeSecurityReleases fixed no fixed version listed
- vendor:Microsoft Office LTSC 2021 affected >= 16.0.1, < 16.0.14334.21048 fixed 16.0.14334.21048
- vendor:Microsoft Office LTSC 2024 affected >= 16.0.0, < 16.0.17932.21140 fixed 16.0.17932.21140
- vendor:Microsoft Office 365 for Mac affected >= 1.0.0, < 16.115.26110837 fixed 16.115.26110837
- vendor:Microsoft Office LTSC for Mac 2021 affected >= 16.0.1, < 16.115.26110837 fixed 16.115.26110837
- vendor:Microsoft Office LTSC for Mac 2024 affected >= 16.0.0, < 16.115.26110837 fixed 16.115.26110837
- vendor:Office Online Server affected >= 16.0.0.0, < 16.0.10417.20236 fixed 16.0.10417.20236

## How to check

In Excel open File > Account > About Excel (Mac: Excel > About Excel) and compare the version with the fixed builds. On Office Online Server, compare the installed build with 16.0.10417.20236. For Microsoft 365 Apps, compare with your update channel's current release at aka.ms/OfficeSecurityReleases.

## Fix

Update to a fixed build: Office LTSC 2021 16.0.14334.21048; Office LTSC 2024 16.0.17932.21140; Office for Mac / LTSC for Mac 2021 and 2024 16.115.26110837; Office Online Server 16.0.10417.20236. Microsoft 365 Apps: the CVE record gives no build, see https://aka.ms/OfficeSecurityReleases for your channel.

## Timeline

- 2026-11-10T19:24:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118722
- 2026-11-10T23:02:57+00:00 analyst https://cveawg.mitre.org/api/cve/CVE-2026-118722 — Read Microsoft's CNA CVE record (affected list and fixed builds). MSRC update guide page is JS-only and unread, so only fix/products verified. Not exploited per CISA SSVC (none); no PoC found. Trigger file/action not stated; CVSS has UI:R. 365 Apps fixed build not in record.

## Documents

- [advisory] CVE record published by Microsoft (CNA): CVE-2026-118722 https://cveawg.mitre.org/api/cve/CVE-2026-118722
- [mentions] MSRC Update Guide: CVE-2026-118722 (not readable without JavaScript) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118722

## From the sources

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_