{"id":"CVE-2026-118724","kind":"vulnerability","aliases":["CVE-2026-118724"],"related":[],"title":"Microsoft Excel: untrusted pointer dereference lets network attacker run code","description":"Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Microsoft Excel remote code execution (CWE-822 untrusted pointer dereference), CVSS 8.8. The CVSS vector needs a user to open a crafted file (UI:R), so teams that receive spreadsheets by email or download are the exposed ones. Affects Microsoft 365 Apps, Office LTSC 2021/2024, Office for Mac and Office Online Server below the Nov 10, 2026 builds; those already on them can skip it. No exploitation or public PoC reported by the sources read.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Office Excel","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Microsoft 365 Apps for Enterprise","fixed":["Current Channel 2610 20527.20196"],"affected":">= 16.0.1, < Nov 10 2026 build (see aka.ms/OfficeSecurityReleases)","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2024","fixed":["16.0.17932.21140"],"affected":">= 16.0.0, < 16.0.17932.21140","ecosystem":"vendor"},{"name":"Microsoft Office LTSC 2021","fixed":["16.0.14334.21048"],"affected":">= 16.0.1, < 16.0.14334.21048","ecosystem":"vendor"},{"name":"Microsoft Office for Mac (365/LTSC 2021/2024)","fixed":["16.115.26110837"],"affected":"< 16.115.26110837","ecosystem":"vendor"},{"name":"Office Online Server","fixed":["16.0.10417.20236"],"affected":"< 16.0.10417.20236","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["excel","macos","microsoft-office","package","user-interaction-required","windows"],"not_affected_if":["patched-nov-2026-build"],"how_to_check":"In Excel: File > Account > About Excel and compare the build with the fixed builds in the fix field. Fleet-wide: inventory the Click-to-Run version. Mac: Excel > About Excel, need 16.115.26110837 or later.","fix":"Install the Nov 10, 2026 Office update: Current Channel 2610 build 20527.20196; Monthly Enterprise 2610 20527.20194 / 2609 20430.20264 / 2608 20326.20320; Semi-Annual Enterprise 2610 20527.20192 / 2609 20430.20262 / 2608 20326.20318; Office LTSC 2024 17932.21140; LTSC 2021 14334.21048; Office 2019 10417.20236. Office for Mac 16.115 (build 26110837) per the CNA record. Office Online Server fixed 16.0.10417.20236 per the CNA record.","status":"open","published_at":"2026-11-10T19:19:48+00:00","first_seen_at":"2026-11-10T19:24:54+00:00","triaged_at":"2026-11-10T19:28:17+00:00","updated_at":"2026-11-10T23:03:07+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T19:28:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Excel: untrusted pointer dereference lets network attacker run code","impact":"high","summary":"Microsoft Excel mishandles a pointer taken from untrusted input, so a specially crafted file or content can corrupt memory. An unauthorized attacker over a network could execute code on the victim's machine.","audience":"everyone","category":"package","nicknames":[],"who_cares":["excel","microsoft-office","windows"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker runs code on the victim's computer over the network","analyst_note":"Check Microsoft's security update guide for CVE-2026-118724 for affected builds, fixed versions and whether user interaction (opening a file) is required.","how_to_check":"- unknown","plain_action":"Update Microsoft Excel through Microsoft's normal security updates once Microsoft releases a fix for CVE-2026-118724.","product_name":"Microsoft Office Excel","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000669,"input_tokens":4496,"output_tokens":438,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Microsoft's security update guide for CVE-2026-118724 for affected builds, fixed versions and whether user interaction (opening a file) is required.","search":"'-118724':13A,16A '-2026':12A,15A '-822':59B '10':108B '2021':32A '2021/2024':38A,97B '2024':28A '2026':109B '365':21A,93B '365/ltsc':37A '8.8':64B 'affect':91B 'allow':135C 'alreadi':112B 'app':94B 'apps':22A 'attack':8A,138C 'build':110B 'code':10A,56B,141C 'craft':74B 'cve':11A,14A 'cvss':63B,66B 'cwe':58B 'derefer':5A,62B,130C 'download':86B 'email':84B 'enterprise':24A 'excel':2A,19A,42B,54B,134C 'execut':57B,140C 'exploit':119B 'expos':89B 'file':75B 'for':23A,35A 'interact':50B 'let':6A 'ltsc':27A,31A,96B 'mac':36A,100B 'maco':43B 'microsoft':1A,17A,20A,25A,29A,33A,45B,53B,92B,132C 'microsoft-offic':44B 'need':68B 'network':7A,144C 'nov':107B 'offic':46B,95B,98B,102B,133C 'office':18A,26A,30A,34A,39A 'one':90B 'onlin':103B 'online':40A 'open':72B 'packag':47B 'poc':122B 'pointer':4A,61B,129C 'public':121B 'r':77B 'read':127B 'receiv':81B 'remot':55B 'report':123B 'requir':51B 'run':9A 'server':41A,104B 'skip':116B 'sourc':126B 'spreadsheet':82B 'team':79B 'ui':76B 'unauthor':137C 'untrust':3A,60B,128C 'user':49B,70B 'user-interaction-requir':48B 'vector':67B 'window':52B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{"fix":{"at":"2026-11-10T23:03:07Z","by":"analyst","doc":"https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","run_id":3093}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["365appsforenterprise","microsoft365appsforenterprise","microsoftofficeexcel","microsoftofficeformac365ltsc20212024","microsoftofficeltsc2021","microsoftofficeltsc2024","officeexcel","officeformac365ltsc20212024","officeltsc2021","officeltsc2024","officeonlineserver","onlineserver"],"ptokens":["2021","2024","365","apps","enterprise","excel","for","ltsc","mac","microsoft","office","online","server"],"labels":["excel","high","macos","microsoftoffice","package","userinteractionrequired","vendor","windows"],"campaign_type":null,"search_a":"'-118724':13A,16A '-2026':12A,15A '2021':32A '2021/2024':38A '2024':28A '365':21A '365/ltsc':37A 'apps':22A 'attack':8A 'code':10A 'cve':11A,14A 'derefer':5A 'enterprise':24A 'excel':2A,19A 'for':23A,35A 'let':6A 'ltsc':27A,31A 'mac':36A 'microsoft':1A,17A,20A,25A,29A,33A 'network':7A 'office':18A,26A,30A,34A,39A 'online':40A 'pointer':4A 'run':9A 'server':41A 'untrust':3A","search_b":"'-822':59B '10':108B '2021/2024':97B '2026':109B '365':93B '8.8':64B 'affect':91B 'alreadi':112B 'app':94B 'build':110B 'code':56B 'craft':74B 'cvss':63B,66B 'cwe':58B 'derefer':62B 'download':86B 'email':84B 'excel':42B,54B 'execut':57B 'exploit':119B 'expos':89B 'file':75B 'interact':50B 'ltsc':96B 'mac':100B 'maco':43B 'microsoft':45B,53B,92B 'microsoft-offic':44B 'need':68B 'nov':107B 'offic':46B,95B,98B,102B 'one':90B 'onlin':103B 'open':72B 'packag':47B 'poc':122B 'pointer':61B 'public':121B 'r':77B 'read':127B 'receiv':81B 'remot':55B 'report':123B 'requir':51B 'server':104B 'skip':116B 'sourc':126B 'spreadsheet':82B 'team':79B 'ui':76B 'untrust':60B 'user':49B,70B 'user-interaction-requir':48B 'vector':67B 'window':52B","search_c":"'allow':135C 'attack':138C 'code':141C 'derefer':130C 'excel':134C 'execut':140C 'microsoft':132C 'network':144C 'offic':133C 'pointer':129C 'unauthor':137C 'untrust':128C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118724","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118724","severity":null,"published_at":"2026-11-10T19:19:48+00:00","modified_at":"2026-11-10T19:19:48+00:00","first_seen_at":"2026-11-10T19:24:54+00:00","fetched_at":"2026-11-10T19:24:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118724:3093","url":"https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","severity":null,"published_at":"2026-11-10T23:03:07+00:00","modified_at":"2026-11-10T23:03:07+00:00","first_seen_at":"2026-11-10T23:03:07+00:00","fetched_at":"2026-11-10T23:03:07+00:00","note":"MSRC page is JS-only; used Microsoft Learn Office release notes (CVE listed under Excel, Nov 10 2026) for fixed builds, and CNA record via OpenCVE for ranges. Only fix verified; affected list and UI-required from CNA record mirror, not verified. No exploitation reported.","cites":["https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","https://learn.microsoft.com/en-us/officeupdates/release-notes-office-for-mac","https://app.opencve.io/cve/CVE-2026-118724"]}],"documents":[{"id":118905,"url":"https://learn.microsoft.com/en-us/OfficeUpdates/microsoft365-apps-security-updates","title":"Release notes for Microsoft Office security updates (Nov 10, 2026)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":119991,"url":"https://learn.microsoft.com/en-us/officeupdates/release-notes-office-for-mac","title":"Release notes for Office for Mac (16.115, Nov 10, 2026)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":119992,"url":"https://app.opencve.io/cve/CVE-2026-118724","title":"OpenCVE: CVE-2026-118724 (mirror of Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}