---
id: "CVE-2026-120786"
page: "https://infrastack.ai/live/CVE-2026-120786"
kind: "vulnerability"
aliases: ["CVE-2026-120786"]
title: "Microsoft Excel: heap buffer overflow lets a remote attacker run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Microsoft Excel (Microsoft 365 Apps / Office)", "fixed": ["Current Channel 2610 20527.20196", "LTSC 2024 17932.21140", "LTSC 2021 14334.21048", "Office 2019 10417.20236"], "affected": "builds before the Nov 10 2026 update; exact range not confirmed", "ecosystem": "vendor"}]
ecosystems: []
tags: ["excel", "microsoft-office", "patch-tuesday", "vendor", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:20:27+00:00"
first_seen_at: "2026-11-10T19:25:08+00:00"
updated_at: "2026-11-10T22:03:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120786", "first_seen_at": "2026-11-10T19:25:08+00:00"}, {"source": "analyst", "url": "https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates", "first_seen_at": "2026-11-10T22:03:36+00:00", "cites": ["https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates", "https://www.rapid7.com/db/vulnerabilities/cve-2026-120786/"]}]
exploit_sources: []
---

# Microsoft Excel: heap buffer overflow lets a remote attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-120786 (this .md is for agents)

Microsoft fixed a heap-based buffer overflow in Excel that allows code execution over a network, in the November 10, 2026 Office security updates. Rapid7 lists a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R), which implies a user must open a file or take some action. No exploitation or public PoC reported in the sources read. The MSRC page could not be rendered, so the trigger and the affected versions are not confirmed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Excel (Microsoft 365 Apps / Office) affected builds before the Nov 10 2026 update; exact range not confirmed fixed Current Channel 2610 20527.20196, LTSC 2024 17932.21140, LTSC 2021 14334.21048, Office 2019 10417.20236

## How to check

In Excel go to File > Account > About Excel and compare the build with the November 10, 2026 builds in Microsoft's Office security update release notes for your channel. A lower build is not patched. The MSRC page for this CVE needs JavaScript and could not be read, so affected versions and whether the Preview Pane triggers it are unconfirmed.

## Fix

Install the November 10, 2026 Office update: Current Channel 2610 build 20527.20196; Monthly Enterprise 2610 build 20527.20194 (2609: 20430.20264, 2608: 20326.20320); Office LTSC 2024 build 17932.21140; LTSC 2021 build 14334.21048; Office 2019 build 10417.20236.

## Timeline

- 2026-11-10T19:25:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120786
- 2026-11-10T22:03:36+00:00 analyst https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates — Vendor release-notes page lists CVE under Excel in the Nov 10 2026 update with fixed builds; MSRC page was JS-only, so affected range and trigger are unconfirmed. Only fix is marked verified. Not in KEV, no exploitation seen. Sibling Excel CVEs: 120785, 120788, 120789, 120790.

## Documents

- [fix] Microsoft Office security updates release notes (Nov 10, 2026) https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
- [mentions] Rapid7: CVE-2026-120786 https://www.rapid7.com/db/vulnerabilities/cve-2026-120786/

## From the sources

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_