{"id":"CVE-2026-120788","kind":"vulnerability","aliases":["CVE-2026-120788"],"related":[],"title":"Microsoft Excel: heap overflow lets unauthenticated network attacker run code","description":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in Microsoft Office Excel (CVSS 8.8, vector AV:N/AC:L/PR:N/UI:R per Rapid7, so a user must open a crafted file or similar). Microsoft lists it as fixed in the November 10, 2026 Office security updates. No exploitation or public PoC found. Not read: the MSRC entry itself, which needs JavaScript.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Excel (Microsoft 365 Apps / Office 2019, 2021, 2024)","fixed":["2610 20527.20196 (Current)","LTSC 2024 17932.21140","LTSC 2021 14334.21048","Office 2019 10417.20236"],"affected":"builds older than the 2026-11-10 update for each channel","ecosystem":"vendor"}],"ecosystems":[],"tags":["desktop","excel","microsoft-office","vendor","windows"],"not_affected_if":[],"how_to_check":"In any Office app: File > Account > About Excel, compare the build with the November 10, 2026 builds for your channel (see fix). Anything older is exposed. Microsoft's Security Update Guide entry (JS-only, not read) lists the exact products.","fix":"Install the November 10, 2026 Office update: Current Channel 2610 build 20527.20196; Monthly Enterprise 2610 20527.20194 / 2609 20430.20264 / 2608 20326.20320; Semi-Annual Enterprise 2610 20527.20192 / 2609 20430.20262 / 2608 20326.20318; Office 2024/2021 Retail 2610 20527.20196; LTSC 2024 2408 build 17932.21140; LTSC 2021 2108 build 14334.21048; Office 2019 1808 build 10417.20236.","status":"open","published_at":"2026-11-10T19:20:27+00:00","first_seen_at":"2026-11-10T19:25:08+00:00","triaged_at":"2026-11-10T19:27:51+00:00","updated_at":"2026-11-10T21:48:18+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-10T19:27:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Excel: heap overflow lets unauthenticated network attacker run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft Office Excel lets an unauthorized attacker execute code over a network. The sources do not say what user action triggers it or which Excel builds are affected.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["microsoft-office","excel","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the victim's machine over the network","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-120788 for affected builds, fixed versions and whether user interaction is required.","how_to_check":"- unknown","plain_action":"Update Microsoft Excel through Microsoft's normal update channel once a fix is listed for your version.","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations and people running Microsoft Office Excel. The sources do not list affected builds or whether a user must open a file.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000666,"input_tokens":4496,"output_tokens":433,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-120788 for affected builds, fixed versions and whether user interaction is required.","search":"'-120788':13A,16A '-2026':12A,15A '10':70B '2019':23A '2021':24A '2024':25A '2026':71B '365':20A '8.8':43B 'allow':99C 'apps':21A 'attack':8A,102C 'av':45B 'base':35B,92C 'buffer':36B,93C 'code':10A,105C 'craft':58B 'cve':11A,14A 'cvss':42B 'desktop':26B 'entri':85B 'excel':2A,18A,27B,41B,98C 'execut':104C 'exploit':76B 'file':59B 'fix':66B 'found':80B 'heap':3A,34B,91C 'heap-bas':33B,90C 'javascript':89B 'l/pr':47B 'let':5A 'list':63B 'microsoft':1A,17A,19A,29B,39B,62B,96C 'microsoft-offic':28B 'msrc':84B 'must':55B 'n/ac':46B 'n/ui':48B 'need':88B 'network':7A,108C 'novemb':69B 'offic':30B,40B,72B,97C 'office':22A 'open':56B 'overflow':4A,37B,94C 'per':50B 'poc':79B 'public':78B 'r':49B 'rapid7':51B 'read':82B 'run':9A 'secur':73B 'similar':61B 'unauthent':6A 'unauthor':101C 'updat':74B 'user':54B 'vector':44B 'vendor':31B 'window':32B","nicknames":[],"mitigations":[],"who_affected":"Organizations and people running Microsoft Office Excel. The sources do not list affected builds or whether a user must open a file.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:48:18Z","by":"analyst","doc":"https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","run_id":2858}},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Update Microsoft Excel through Microsoft's normal update channel once a fix is listed for your version.","pkeys":["excelmicrosoft365appsoffice201920212024","microsoftexcelmicrosoft365appsoffice201920212024"],"ptokens":["2019","2021","2024","365","apps","excel","microsoft","office"],"labels":["desktop","excel","high","microsoftoffice","vendor","windows"],"campaign_type":null,"search_a":"'-120788':13A,16A '-2026':12A,15A '2019':23A '2021':24A '2024':25A '365':20A 'apps':21A 'attack':8A 'code':10A 'cve':11A,14A 'excel':2A,18A 'heap':3A 'let':5A 'microsoft':1A,17A,19A 'network':7A 'office':22A 'overflow':4A 'run':9A 'unauthent':6A","search_b":"'10':70B '2026':71B '8.8':43B 'av':45B 'base':35B 'buffer':36B 'craft':58B 'cvss':42B 'desktop':26B 'entri':85B 'excel':27B,41B 'exploit':76B 'file':59B 'fix':66B 'found':80B 'heap':34B 'heap-bas':33B 'javascript':89B 'l/pr':47B 'list':63B 'microsoft':29B,39B,62B 'microsoft-offic':28B 'msrc':84B 'must':55B 'n/ac':46B 'n/ui':48B 'need':88B 'novemb':69B 'offic':30B,40B,72B 'open':56B 'overflow':37B 'per':50B 'poc':79B 'public':78B 'r':49B 'rapid7':51B 'read':82B 'secur':73B 'similar':61B 'updat':74B 'user':54B 'vector':44B 'vendor':31B 'window':32B","search_c":"'allow':99C 'attack':102C 'base':92C 'buffer':93C 'code':105C 'excel':98C 'execut':104C 'heap':91C 'heap-bas':90C 'microsoft':96C 'network':108C 'offic':97C 'overflow':94C 'unauthor':101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120788","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120788","severity":null,"published_at":"2026-11-10T19:20:27+00:00","modified_at":"2026-11-10T19:20:28+00:00","first_seen_at":"2026-11-10T19:25:08+00:00","fetched_at":"2026-11-10T19:25:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120788:2858","url":"https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","severity":null,"published_at":"2026-11-10T21:48:18+00:00","modified_at":"2026-11-10T21:48:18+00:00","first_seen_at":"2026-11-10T21:48:18+00:00","fetched_at":"2026-11-10T21:48:18+00:00","note":"Fix builds confirmed on Microsoft Learn Office release notes (Nov 10, 2026 lists this CVE under Excel). MSRC page not readable; UI-required and affected range come from Rapid7 CVSS vector only, so not verified. No exploitation seen in KEV/Rapid7.","cites":["https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","https://www.rapid7.com/db/vulnerabilities/cve-2026-120788/"]}],"documents":[{"id":118854,"url":"https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","title":"Release notes for Microsoft Office security updates (Nov 10, 2026)","kind":"vendor","source":"analyst","publisher":null,"text":"November 10, 2026: Current Channel 2610 (20527.20196); MEC 2610 (20527.20194), 2609 (20430.20264), 2608 (20326.20320); SAEC 2610 (20527.20192), 2609 (20430.20262), 2608 (20326.20318); Office 2024/2021 Retail 2610 (20527.20196); LTSC 2024 2408 (17932.21140); LTSC 2021 2108 (14334.21048); Office 2019 1808 (10417.20236). CVE-2026-118301 listed under Excel.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":119277,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-120788/","title":"Rapid7: CVE-2026-120788","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}