---
id: "CVE-2026-118723"
page: "https://infrastack.ai/live/CVE-2026-118723"
kind: "vulnerability"
aliases: ["CVE-2026-118723"]
title: "Microsoft Excel: untrusted pointer use lets a local attacker run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Microsoft Office Excel", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["excel", "microsoft-office", "package", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:19:48+00:00"
first_seen_at: "2026-11-10T19:24:54+00:00"
updated_at: "2026-11-10T19:40:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118723", "first_seen_at": "2026-11-10T19:24:54+00:00"}]
exploit_sources: []
---

# Microsoft Excel: untrusted pointer use lets a local attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-118723 (this .md is for agents)

A flaw in Microsoft Office Excel lets an unauthorized attacker trigger an untrusted pointer dereference that can run code on the machine. The attack is local, so the attacker needs access to the computer or a way to get a user to open a crafted file.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Office Excel affected range not listed fixed no fixed version listed

## How to check

- Open Excel and check the version under File > Account > About Excel.
- Confirm whether Microsoft Office updates are installed through Microsoft AutoUpdate or Windows Update.

## Timeline

- 2026-11-10T19:24:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118723

## From the sources

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_