---
id: "CVE-2026-120785"
page: "https://infrastack.ai/live/CVE-2026-120785"
kind: "vulnerability"
aliases: ["CVE-2026-120785"]
title: "Microsoft Excel: heap buffer overflow lets a remote attacker run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Microsoft Excel (Microsoft 365 Apps / Office)", "fixed": ["2610 20527.20196 (Current Channel, Office 2024/2021 Retail)", "LTSC 2024 17932.21140", "LTSC 2021 14334.21048", "Office 2019 10417.20236"], "affected": "builds older than the 2026-11-10 update (lower bound not stated)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["excel", "microsoft-365-apps", "microsoft-office", "office-2019", "office-ltsc", "other", "windows"]
not_affected_if: ["patched-nov-2026-build"]
published_at: "2026-11-10T19:20:27+00:00"
first_seen_at: "2026-11-10T19:25:08+00:00"
updated_at: "2026-11-10T22:05:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120785", "first_seen_at": "2026-11-10T19:25:08+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120785", "first_seen_at": "2026-11-10T22:05:00+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-120785", "https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates"]}]
exploit_sources: []
---

# Microsoft Excel: heap buffer overflow lets a remote attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-120785 (this .md is for agents)

A heap-based buffer overflow in Microsoft Office Excel lets an unauthorized attacker reach code execution over a network. The sources give no fixed version or setting for this CVE.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Excel (Microsoft 365 Apps / Office) affected builds older than the 2026-11-10 update (lower bound not stated) fixed 2610 20527.20196 (Current Channel, Office 2024/2021 Retail), LTSC 2024 17932.21140, LTSC 2021 14334.21048, Office 2019 10417.20236

## How to check

In Excel open File > Account > About Excel and compare the version/build with the Nov 10, 2026 builds in the fix field (for example Current Channel 2610 build 20527.20196). An older build is not patched. Microsoft's page does not state the oldest affected build.

## Fix

Update Microsoft Office to the Nov 10, 2026 build: Microsoft 365 Apps Current Channel 2610 build 20527.20196 (Monthly Enterprise 2610: 20527.20194, 2609: 20430.20264, 2608: 20326.20320; Semi-Annual 2610: 20527.20192, 2609: 20430.20262, 2608: 20326.20318); Office 2024/2021 Retail 2610 build 20527.20196; Office LTSC 2024 VL 2408 build 17932.21140; LTSC 2021 VL 2108 build 14334.21048; Office 2019 VL 1808 build 10417.20236.

## Timeline

- 2026-11-10T19:25:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120785
- 2026-11-10T22:05:00+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-120785 — MSRC page is JS-only; used Microsoft Learn Office security release notes (Nov 10, 2026) listing this CVE under Excel with fixed builds. User interaction: UI:R per CVSS vector only (NVD), not read in MSRC text. Affected-range lower bound and exploit status unknown; no PoC/exploitation seen (not searched on X, tier B).

## Documents

- [advisory] NVD CVE-2026-120785 https://nvd.nist.gov/vuln/detail/CVE-2026-120785
- [fix] Microsoft Office security updates release notes (Nov 10, 2026) https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates

## From the sources

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_