{"id":"CVE-2026-118731","kind":"vulnerability","aliases":["CVE-2026-118731"],"related":[],"title":"Microsoft Excel: crafted workbook can run code when a user opens it and uses a chart","description":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Microsoft rates this Important (CVSS 8.8), Exploitation Less Likely, not publicly disclosed and not exploited. A stack-based buffer overflow (CWE-121) in Excel. Microsoft says an attacker must convince a user to open a crafted workbook, activate its embedded chart and use Decrease Decimal on a cell in the chart's datasheet; code then runs with that user's privileges. The Preview Pane is not an attack vector.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["excel","microsoft-office","other","user-interaction","windows"],"not_affected_if":["preview-pane-only"],"how_to_check":"Open Excel, File > Account, note the version/build, and compare with the fixed build listed for your Office channel on https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118731 (the fixed builds were not readable from the API data; JS-only page). Apply the November 2026 Office updates.","fix":null,"status":"open","published_at":"2026-11-10T19:19:49+00:00","first_seen_at":"2026-11-10T19:24:54+00:00","triaged_at":"2026-11-10T19:28:14+00:00","updated_at":"2026-11-10T23:01:53+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T19:28:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Excel: stack buffer overflow lets a network attacker run code","impact":"high","summary":"A stack-based buffer overflow in Microsoft Office Excel lets an unauthorized attacker trigger memory corruption over a network. The sources say the attacker can execute code on the affected machine.","audience":"everyone","category":"other","nicknames":[],"who_cares":["microsoft-office","excel","windows"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker runs code on the victim's machine over the network","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-118731 for affected builds, fixed versions and whether user interaction (opening a file) is required.","how_to_check":"- Open Excel and check the version under File > Account (or About Excel) against the Microsoft security update guide entry for this CVE\n- unknown","plain_action":"Update Microsoft Excel through Microsoft's usual Office updates once a fix is released.","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000669,"input_tokens":4496,"output_tokens":438,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-118731 for affected builds, fixed versions and whether user interaction (opening a file) is required.","search":"'-118731':19A,22A '-121':54B '-2026':18A,21A '8.8':37B 'activ':70B 'allow':111C 'attack':60B,100B,114C 'base':50B,104C 'buffer':51B,105C 'cell':80B 'chart':16A,73B,83B 'code':7A,86B,117C 'convinc':62B 'craft':3A,68B 'cve':17A,20A 'cvss':36B 'cwe':53B 'datasheet':85B 'decim':77B 'decreas':76B 'disclos':43B 'embed':72B 'excel':2A,23B,56B,110C 'execut':116C 'exploit':38B,46B 'import':35B 'interact':30B 'less':39B 'like':40B 'microsoft':1A,25B,32B,57B,108C 'microsoft-offic':24B 'must':61B 'network':120C 'offic':26B,109C 'open':11A,66B 'overflow':52B,106C 'pane':96B 'preview':95B 'privileg':93B 'public':42B 'rate':33B 'run':6A,88B 'say':58B 'stack':49B,103C 'stack-bas':48B,102C 'unauthor':113C 'use':14A,75B 'user':10A,29B,64B,91B 'user-interact':28B 'vector':101B 'window':31B 'workbook':4A,69B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Microsoft Office Excel on a machine where users open workbooks from outside sources (email, downloads, shared links). Microsoft's entry does not list the affected builds in the data we could read, so check the Security Update Guide page for your Office channel. The Preview Pane is not a vector, and the attack needs the user to open the file and interact with an embedded chart.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"Install the latest Microsoft Office updates: in Excel choose File > Account > Update Options > Update Now.","pkeys":[],"ptokens":[],"labels":["excel","high","microsoftoffice","other","userinteraction","windows"],"campaign_type":null,"search_a":"'-118731':19A,22A '-2026':18A,21A 'chart':16A 'code':7A 'craft':3A 'cve':17A,20A 'excel':2A 'microsoft':1A 'open':11A 'run':6A 'use':14A 'user':10A 'workbook':4A","search_b":"'-121':54B '8.8':37B 'activ':70B 'attack':60B,100B 'base':50B 'buffer':51B 'cell':80B 'chart':73B,83B 'code':86B 'convinc':62B 'craft':68B 'cvss':36B 'cwe':53B 'datasheet':85B 'decim':77B 'decreas':76B 'disclos':43B 'embed':72B 'excel':23B,56B 'exploit':38B,46B 'import':35B 'interact':30B 'less':39B 'like':40B 'microsoft':25B,32B,57B 'microsoft-offic':24B 'must':61B 'offic':26B 'open':66B 'overflow':52B 'pane':96B 'preview':95B 'privileg':93B 'public':42B 'rate':33B 'run':88B 'say':58B 'stack':49B 'stack-bas':48B 'use':75B 'user':29B,64B,91B 'user-interact':28B 'vector':101B 'window':31B 'workbook':69B","search_c":"'allow':111C 'attack':114C 'base':104C 'buffer':105C 'code':117C 'excel':110C 'execut':116C 'microsoft':108C 'network':120C 'offic':109C 'overflow':106C 'stack':103C 'stack-bas':102C 'unauthor':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118731","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118731","severity":null,"published_at":"2026-11-10T19:19:49+00:00","modified_at":"2026-11-10T19:19:49+00:00","first_seen_at":"2026-11-10T19:24:54+00:00","fetched_at":"2026-11-10T19:24:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118731:3088","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118731","severity":null,"published_at":"2026-11-10T23:01:53+00:00","modified_at":"2026-11-10T23:01:53+00:00","first_seen_at":"2026-11-10T23:01:53+00:00","fetched_at":"2026-11-10T23:01:53+00:00","note":"MSRC SUG API read: Important, 8.8, Exploitation Less Likely, not exploited, UI required (open file, activate chart, Decrease Decimal). No product/build/KB table in readable data, so fix versions unknown and nothing marked verified. Triage's fix_status none was unsupported; set unknown. X/search not used.","cites":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118731"]}],"documents":[{"id":119984,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118731","title":"MSRC: CVE-2026-118731 Microsoft Office Excel Remote Code Execution Vulnerability","kind":"advisory","source":"analyst","publisher":null,"text":"Important, CVSS 8.8 (AV:N/AC:L/PR:N/UI:R), Exploitation Less Likely, not publicly disclosed, not exploited. Preview Pane is not an attack vector. Attacker convinces user to open a crafted workbook in an affected Office version, activate its embedded chart, and use Decrease Decimal on a cell in the chart's datasheet; code runs with the user's privileges. CWE-121. Released 2026-11-10 (Nov Patch Tuesday). Customer action required. API data lists no product/build table.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}