---
id: "CVE-2026-118729"
page: "https://infrastack.ai/live/CVE-2026-118729"
kind: "vulnerability"
aliases: ["CVE-2026-118729"]
title: "Microsoft Excel: use-after-free lets an attacker run code when a user opens a crafted file"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Microsoft 365 Apps for Enterprise", "fixed": ["2610 build 20527.20196"], "affected": ">= 16.0.1, < build in aka.ms/OfficeSecurityReleases", "ecosystem": "vendor"}, {"name": "Office LTSC 2021", "fixed": ["16.0.14334.21048"], "affected": ">= 16.0.1, < 16.0.14334.21048", "ecosystem": "vendor"}, {"name": "Office LTSC 2024", "fixed": ["16.0.17932.21140"], "affected": ">= 16.0.0, < 16.0.17932.21140", "ecosystem": "vendor"}, {"name": "Office for Mac (365, LTSC 2021, LTSC 2024)", "fixed": ["16.115.26110837"], "affected": "< 16.115.26110837", "ecosystem": "vendor"}, {"name": "Office Online Server", "fixed": ["16.0.10417.20236"], "affected": ">= 16.0.0.0, < 16.0.10417.20236", "ecosystem": "vendor"}]
ecosystems: []
tags: ["excel", "macos", "microsoft-office", "other", "user-interaction", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:19:49+00:00"
first_seen_at: "2026-11-10T19:24:54+00:00"
updated_at: "2026-11-10T23:01:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118729", "first_seen_at": "2026-11-10T19:24:54+00:00"}, {"source": "analyst", "url": "https://app.opencve.io/cve/CVE-2026-118729", "first_seen_at": "2026-11-10T23:01:49+00:00", "cites": ["https://app.opencve.io/cve/CVE-2026-118729", "https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates"]}]
exploit_sources: []
---

# Microsoft Excel: use-after-free lets an attacker run code when a user opens a crafted file

Link for people: https://infrastack.ai/live/CVE-2026-118729 (this .md is for agents)

Use-after-free (CWE-416) in Microsoft Office Excel, patched in Microsoft's 10 Nov 2026 updates. CVSS 8.8 (AV:N/UI:R): the user has to open a crafted file or content. No exploitation reported; not in CISA KEV.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft 365 Apps for Enterprise affected >= 16.0.1, < build in aka.ms/OfficeSecurityReleases fixed 2610 build 20527.20196
- vendor:Office LTSC 2021 affected >= 16.0.1, < 16.0.14334.21048 fixed 16.0.14334.21048
- vendor:Office LTSC 2024 affected >= 16.0.0, < 16.0.17932.21140 fixed 16.0.17932.21140
- vendor:Office for Mac (365, LTSC 2021, LTSC 2024) affected < 16.115.26110837 fixed 16.115.26110837
- vendor:Office Online Server affected >= 16.0.0.0, < 16.0.10417.20236 fixed 16.0.10417.20236

## How to check

Check your Office build against the 10 Nov 2026 security release notes (learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates). Per the CVE record, fixed builds: Office LTSC 2021 16.0.14334.21048, Office LTSC 2024 16.0.17932.21140, Office for Mac and LTSC for Mac 16.115.26110837, Office Online Server 16.0.10417.20236; Microsoft 365 Apps: current channel 2610 build 20527.20196 or later per the release notes. In Excel: File > Account > About Excel shows the build.

## Fix

Update Office to the 10 Nov 2026 security build: LTSC 2021 16.0.14334.21048, LTSC 2024 16.0.17932.21140, Mac 16.115.26110837, Office Online Server 16.0.10417.20236, Microsoft 365 Apps per aka.ms/OfficeSecurityReleases.

## Timeline

- 2026-11-10T19:24:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118729
- 2026-11-10T23:01:49+00:00 analyst https://app.opencve.io/cve/CVE-2026-118729 — MSRC page is JS-only and did not render, so nothing is marked verified. Versions come from the CNA (Microsoft) CVE record via OpenCVE, and the 2610 build from the Office release notes. Exposure and fix not confirmed on the MSRC page itself. Not exploited. UI:R per the vector.

## Documents

- [describes] OpenCVE: CVE-2026-118729 (CNA record from Microsoft) https://app.opencve.io/cve/CVE-2026-118729
- [mentions] Microsoft Office security updates release notes (Nov 10, 2026) https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates

## From the sources

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_