SB2026111131 - Multiple vulnerabilities in Microsoft Office

Security Bulletin ID SB2026111131

CSH Severity

High

Patch available

YES

Number of vulnerabilities 85

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 85 vulnerabilities.

1) Heap-based buffer overflow (CVE-ID: CVE-2026-120785)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in the context of the signed-in user.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing specially crafted workbooks. A remote attacker can convince a user to open a specially crafted workbook and interact with affected workbook features to execute arbitrary code in the context of the signed-in user.

The Preview Pane is not an attack vector.

2) Integer overflow (CVE-ID: CVE-2026-123378)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the affected system.

The vulnerability exists due to integer overflow or wraparound in Microsoft Office Outlook when processing a large, specially crafted message. A remote attacker can deliver such a message and induce user interaction to execute arbitrary code.

Successful exploitation requires the targeted system to have sufficient available memory to process the specially crafted message.

3) Heap-based buffer overflow (CVE-ID: CVE-2026-123377)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Outlook when processing a crafted contact file while viewing the contact's certificates. A remote attacker can send a specially crafted contact file and convince a user to open it in Outlook and view the contact's certificates to execute arbitrary code with that user's privileges.

The Preview Pane is not an attack vector for this vulnerability.

4) Heap-based buffer overflow (CVE-ID: CVE-2026-123376)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the affected system.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Outlook when processing a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

5) Stack-based buffer overflow (CVE-ID: CVE-2026-123375)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to a stack-based buffer overflow in Microsoft Office Outlook when previewing a specially crafted attachment. A remote attacker can send such an attachment and convince a user to preview it in Outlook to execute arbitrary code with that user's privileges.

The Preview Pane is not an attack vector for this vulnerability.

6) Heap-based buffer overflow (CVE-ID: CVE-2026-122198)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the permissions of the victim user.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office when a user views a folder containing a specially crafted file. A remote attacker can convince a user to view such a folder, without opening the file, to execute arbitrary code with that user's permissions.

The Preview Pane is not an attack vector.

7) Heap-based buffer overflow (CVE-ID: CVE-2026-120791)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in the context of the signed-in user.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing specially crafted workbooks. A remote attacker can convince a user to open a specially crafted workbook and interact with affected workbook features to execute arbitrary code in the context of the signed-in user.

The Preview Pane is not an attack vector for this vulnerability.

8) Heap-based buffer overflow (CVE-ID: CVE-2026-120790)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in the context of the signed-in user.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing specially crafted workbooks. A remote attacker can convince a user to open a specially crafted workbook and interact with affected workbook features to execute arbitrary code in the context of the signed-in user.

The Preview Pane is not an attack vector.

9) Heap-based buffer overflow (CVE-ID: CVE-2026-120789)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in the context of the signed-in user.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing specially crafted workbooks and interacting with affected workbook features. A remote attacker can convince a user to open a specially crafted workbook and interact with those features to execute arbitrary code in the context of the signed-in user.

The Preview Pane is not an attack vector for this vulnerability.

10) Heap-based buffer overflow (CVE-ID: CVE-2026-120788)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in the context of the signed-in user.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing specially crafted workbooks. A remote attacker can convince a user to open a specially crafted workbook and interact with affected workbook features to execute arbitrary code in the context of the signed-in user.

The Preview Pane is not an attack vector for this vulnerability.

11) Heap-based buffer overflow (CVE-ID: CVE-2026-120786)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in the context of the signed-in user.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a specially crafted workbook and handling interaction with affected workbook features. A remote attacker can convince a user to open the workbook and interact with those features to execute arbitrary code in the context of the signed-in user.

The Preview Pane is not an attack vector.

12) Heap-based buffer overflow (CVE-ID: CVE-2026-123379)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on a system running Microsoft Office Outlook.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Outlook when processing a large, specially crafted message. A remote attacker can send such a message and induce user interaction with it to trigger memory corruption and execute arbitrary code.

Successful exploitation requires the targeted system to have sufficient available memory to process the crafted message.

13) Heap-based buffer overflow (CVE-ID: CVE-2026-120003)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office when processing crafted content. A remote attacker can induce a user to process specially crafted content to corrupt heap memory and execute arbitrary code.

The Preview Pane is also an attack vector.

14) Heap-based buffer overflow (CVE-ID: CVE-2026-120001)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in the context of the victim user.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office PowerPoint when processing a specially crafted audio file. A remote attacker can convince a user to import the crafted audio file into PowerPoint to execute arbitrary code in that user's context.

The Preview Pane is also an attack vector.

15) Out-of-bounds read (CVE-ID: CVE-2026-119999)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when processing input. A remote attacker can supply specially crafted content that requires user interaction to potentially read small portions of heap memory.

The Preview Pane is not an attack vector for this vulnerability.

16) Product UI does not warn user of unsafe actions (CVE-ID: CVE-2026-119998)

CWE-ID: CWE-356 - Product UI does not Warn User of Unsafe Actions

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass Office Protected View and cause documents to open in editing mode rather than protected mode.

The vulnerability exists due to missing warnings about unsafe actions in the Microsoft Office user interface when opening documents. A remote attacker can induce a user to open a document without the expected security warning to bypass Office Protected View.

The Preview Pane is not an attack vector for this vulnerability.

17) Heap-based buffer overflow (CVE-ID: CVE-2026-119997)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the victim's system.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Outlook when processing a malicious Office file. A remote attacker can send a specially crafted Office file and convince a user to open it to execute arbitrary code on the victim's system.

The Preview Pane is not an attack vector for this vulnerability.

18) Heap-based buffer overflow (CVE-ID: CVE-2026-119996)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on an affected system.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Outlook when processing attacker-controlled input. A remote attacker can supply specially crafted input that, with user interaction, triggers heap memory corruption to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

19) Heap-based buffer overflow (CVE-ID: CVE-2026-119995)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Outlook when processing a specially crafted Office document. A remote attacker can send a malicious Office file to a user and convince them to open it to execute arbitrary code.

Successful exploitation requires the affected application to be able to allocate a large amount of memory while processing the crafted document.

20) Type Confusion (CVE-ID: CVE-2026-119993)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose information from Microsoft Office Outlook application memory.

The vulnerability exists due to type confusion in Microsoft Office Outlook when accessing a resource using an incompatible type. A remote attacker can exploit this flaw over a network, with user interaction, to potentially read small portions of the application's memory.

The Preview Pane is not an attack vector for this vulnerability.

21) Heap-based buffer overflow (CVE-ID: CVE-2026-119986)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening the file to execute arbitrary code.

The Preview Pane is not an attack vector.

22) Use-after-free (CVE-ID: CVE-2026-118732)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

23) Heap-based buffer overflow (CVE-ID: CVE-2026-124174)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening the file to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

24) Buffer over-read (CVE-ID: CVE-2026-124233)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose information from small portions of heap memory.

The vulnerability exists due to a buffer over-read in Microsoft Office Word when processing a malicious Office file. A remote attacker can send a specially crafted Office file to a user and convince them to open it to disclose information from heap memory.

The Preview Pane is not an attack vector.

25) Deserialization of Untrusted Data (CVE-ID: CVE-2026-124229)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to execute arbitrary code.

The vulnerability exists due to deserialization of untrusted data in Microsoft Office Excel when processing serialized input. An attacker with physical access to system can exploit the processing of crafted serialized data through physical access, with user interaction, to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

26) Path traversal (CVE-ID: CVE-2026-124228)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code with the victim user's permissions.

The vulnerability exists due to path traversal in Microsoft Office Outlook when synchronizing signature content to a user's desktop client. A remote user can submit specially crafted signature content over the network using access to the user's Outlook account to execute arbitrary code with the user's permissions.

27) Use of uninitialized resource (CVE-ID: CVE-2026-124227)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the affected system.

The vulnerability exists due to use of an uninitialized resource in Microsoft Office Outlook when processing a malicious Office file. A remote attacker can send a specially crafted Office file to a user and convince them to open it to execute arbitrary code.

Successful exploitation depends on specific memory conditions in the affected application that the attacker cannot fully control, making exploitation unreliable.

28) Use-after-free (CVE-ID: CVE-2026-124187)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in the victim user's context.

The vulnerability exists due to use-after-free in Microsoft Office Excel when processing a specially crafted workbook. A remote attacker can send a specially crafted Excel workbook and convince a user to open it and review tracked changes to execute arbitrary code in that user's context.

The Preview Pane is not an attack vector for this vulnerability.

29) Use of uninitialized resource (CVE-ID: CVE-2026-124185)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the affected system.

The vulnerability exists due to use of an uninitialized resource in Microsoft Office Word when processing malicious Office files. A remote attacker can send a specially crafted Office file to a user and convince them to open it to execute arbitrary code.

The Preview Pane is also an attack vector.

30) Buffer over-read (CVE-ID: CVE-2026-124183)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose potentially sensitive information from heap memory.

The vulnerability exists due to a buffer over-read in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a specially crafted Office file to a user and convince them to open it to potentially read small portions of heap memory.

The Preview Pane is not an attack vector for this vulnerability.

31) Out-of-bounds read (CVE-ID: CVE-2026-124179)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose information from heap memory.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a specially crafted Office file to a user and convince them to open it to potentially read small portions of heap memory.

The Preview Pane is not an attack vector.

32) Out-of-bounds read (CVE-ID: CVE-2026-124178)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a specially crafted Office file and convince a user to open it to potentially read small portions of heap memory.

The Preview Pane is not an attack vector for this vulnerability.

33) Heap-based buffer overflow (CVE-ID: CVE-2026-124176)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening the file to execute arbitrary code.

The Preview Pane is not an attack vector.

34) Stack-based buffer overflow (CVE-ID: CVE-2026-118731)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to a stack-based buffer overflow in Microsoft Office Excel when processing a specially crafted workbook. A remote attacker can convince a user to open the workbook, activate its embedded chart, and use Decrease Decimal on a cell in the chart's datasheet to execute arbitrary code with the user's privileges.

The Preview Pane is not an exploitation vector.

35) Heap-based buffer overflow (CVE-ID: CVE-2026-124170)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a specially crafted Office file and convince a user to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

36) Code Injection (CVE-ID: CVE-2026-123395)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose file content accessible to the compromised user.

The vulnerability exists due to improper control of code generation in Microsoft Office Excel when its Data Streamer add-in connects to a local application. A local user can run a malicious application locally and convince a user to connect the add-in to that application to disclose file content.

The scope of accessible file content depends on the privileges of the compromised user.

37) Heap-based buffer overflow (CVE-ID: CVE-2026-123394)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the victim's system.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Word when processing a specially crafted file. A remote attacker can trick a user into opening the file to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

38) Stack-based buffer overflow (CVE-ID: CVE-2026-123385)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to a stack-based buffer overflow in Microsoft Office Excel when processing a specially crafted workbook. A remote attacker can send such a workbook and convince a user to open it, enable editing, and allow its accompanying content to load to execute arbitrary code with that user's privileges.

The Preview Pane is not an attack vector for this vulnerability.

39) Heap-based buffer overflow (CVE-ID: CVE-2026-123384)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the client system.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Outlook when processing a malicious server's response. A remote attacker can host a malicious server and convince a user to connect to it from an affected client to execute arbitrary code on the client system.

The Preview Pane is not an attack vector for this vulnerability.

40) Heap-based buffer overflow (CVE-ID: CVE-2026-123383)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Outlook when an attachment copied from Outlook is processed by another application. A remote attacker can send a specially crafted email and convince a user to copy its attachment in Outlook to trigger code execution when another application processes the copied attachment.

The Preview Pane is not an attack vector for this vulnerability.

41) Untrusted Pointer Dereference (CVE-ID: CVE-2026-123382)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to untrusted pointer dereference in Microsoft Office Outlook when processing a specially crafted file. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

42) Stack-based buffer overflow (CVE-ID: CVE-2026-123381)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a stack-based buffer overflow in Microsoft Office Outlook when processing files. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

43) Heap-based buffer overflow (CVE-ID: CVE-2026-123380)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Outlook when an email attachment copied from Outlook is processed by another application. A remote attacker can send a specially crafted email and convince a user to copy its attachment in Outlook for processing by another application to execute arbitrary code with the user's privileges.

The Preview Pane is not an attack vector for this vulnerability.

44) Use of uninitialized resource (CVE-ID: CVE-2026-118301)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use of an uninitialized resource in Microsoft Office Excel when processing content. A remote attacker can provide specially crafted content that, when processed with user interaction, triggers the use of an uninitialized resource to execute arbitrary code.

The Preview Pane is not an attack vector.

45) Heap-based buffer overflow (CVE-ID: CVE-2026-118709)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening the file to execute arbitrary code.

The Preview Pane is not an attack vector.

46) Release of invalid pointer or reference (CVE-ID: CVE-2026-118708)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on an affected system.

The vulnerability exists due to release of an invalid pointer or reference in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code on the affected system.

The Preview Pane is not an attack vector.

47) Heap-based buffer overflow (CVE-ID: CVE-2026-118707)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the affected system.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code on the affected system.

The Preview Pane is not an attack vector for this vulnerability.

48) Use-after-free (CVE-ID: CVE-2026-118706)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to use-after-free in Microsoft Office Excel when converting a specially crafted workbook to a different file format. A remote attacker can convince a user to perform this conversion using affected Office software to execute arbitrary code with that user's privileges.

The Preview Pane is not an attack vector.

49) Heap-based buffer overflow (CVE-ID: CVE-2026-118705)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the affected system.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code on the affected system.

The Preview Pane is not an attack vector for this vulnerability.

50) Stack-based buffer overflow (CVE-ID: CVE-2026-118704)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to a stack-based buffer overflow in Microsoft Office Excel when processing a specially crafted Office document containing an embedded chart. A remote attacker can convince a user to open the document, activate its embedded chart, and select an element in that chart to execute arbitrary code with the user's privileges.

The Preview Pane is not an attack vector for this vulnerability.

51) Use-after-free (CVE-ID: CVE-2026-118703)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to use-after-free in Microsoft Office Excel when handling objects in a specially crafted workbook. A remote attacker can convince a user to open the workbook, cut and paste an object in it, and then close the application to execute arbitrary code with the user's privileges.

The Preview Pane is not an attack vector.

52) Heap-based buffer overflow (CVE-ID: CVE-2026-118701)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a specially crafted workbook that a user opens and saves. A remote attacker can convince a user to open and save such a workbook to execute arbitrary code with that user's privileges.

The Preview Pane is not an attack vector.

53) Stack-based buffer overflow (CVE-ID: CVE-2026-118700)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a stack-based buffer overflow in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code.

The Preview Pane is not an attack vector.

54) Heap-based buffer overflow (CVE-ID: CVE-2026-118302)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when creating a Forecast Sheet with modified forecast options in a specially crafted workbook. A remote attacker can convince a user to open the crafted workbook and create the Forecast Sheet with modified forecast options to execute arbitrary code with the user's privileges.

The Preview Pane is not an attack vector for this vulnerability.

55) Use-after-free (CVE-ID: CVE-2026-118710)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to use-after-free in Microsoft Office Excel when converting a specially crafted workbook to a different file format. A remote attacker can convince a user to perform this conversion using affected Office software to execute arbitrary code with that user's privileges.

The Preview Pane is not an attack vector for this vulnerability.

56) Out-of-bounds read (CVE-ID: CVE-2026-118300)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose information from small portions of stack memory.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when processing input that causes access beyond a memory boundary. A remote attacker can supply crafted input that, with user interaction, triggers the out-of-bounds read to disclose information from stack memory.

The Preview Pane is not an attack vector for this vulnerability.

57) Heap-based buffer overflow (CVE-ID: CVE-2026-118299)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when applying AutoFormat to cells in a specially crafted spreadsheet. A remote attacker can convince a user to open the spreadsheet and apply AutoFormat to its cells to execute arbitrary code with that user's privileges.

58) Heap-based buffer overflow (CVE-ID: CVE-2026-118298)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a specially crafted Office document and its embedded chart. A remote attacker can convince a user to open the document and activate its embedded chart to execute arbitrary code with that user's privileges.

The Preview Pane is not an attack vector.

59) Heap-based buffer overflow (CVE-ID: CVE-2026-118297)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on an affected system.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening the file to execute arbitrary code on the affected system.

The Preview Pane is not an attack vector for this vulnerability.

60) Double free (CVE-ID: CVE-2026-118296)

CWE-ID: CWE-415 - Double Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a double free in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

61) Stack-based buffer overflow (CVE-ID: CVE-2026-118295)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a stack-based buffer overflow in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening the file to execute arbitrary code.

The Preview Pane is not an attack vector.

62) Heap-based buffer overflow (CVE-ID: CVE-2026-118294)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a specially crafted workbook and updating its external links. A remote attacker can convince a user to open the workbook and enable updates to its external links to execute arbitrary code with that user's privileges.

The Preview Pane is not an attack vector for this vulnerability.

63) Out-of-bounds read (CVE-ID: CVE-2026-118293)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when processing a specially crafted workbook. A remote attacker can convince a user to open the workbook and enable updates to its external links to execute arbitrary code with the user's privileges.

The Preview Pane is not an attack vector.

64) Stack-based buffer overflow (CVE-ID: CVE-2026-118292)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to a stack-based buffer overflow in Microsoft Office Excel when processing a specially crafted workbook saved in a different file format. A remote attacker can convince a user to open the crafted workbook and save it in a different file format to execute arbitrary code with the user's privileges.

The Preview Pane is not an attack vector for this vulnerability.

65) Stack-based buffer overflow (CVE-ID: CVE-2026-118720)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to a stack-based buffer overflow in Microsoft Office Excel when processing a specially crafted workbook using formula evaluation. A remote attacker can convince a user to open the workbook, use Evaluate Formula, and select Step In to execute arbitrary code with that user's privileges.

The Preview Pane is not an attack vector.

66) Use-after-free (CVE-ID: CVE-2026-118730)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the affected system.

The vulnerability exists due to use-after-free in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

67) Use-after-free (CVE-ID: CVE-2026-118729)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.

The Preview Pane is not an attack vector.

68) Out-of-bounds read (CVE-ID: CVE-2026-118728)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when processing attacker-controlled input. A remote attacker can induce a user to trigger processing of specially crafted input to read memory beyond the intended buffer boundaries and disclose sensitive information.

The Preview Pane is not an attack vector for this vulnerability.

69) Out-of-bounds read (CVE-ID: CVE-2026-118727)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when processing input with user interaction. A remote attacker can supply crafted input that causes reads beyond the bounds of a memory buffer to disclose sensitive information.

The Preview Pane is not an attack vector for this vulnerability.

70) Heap-based buffer overflow (CVE-ID: CVE-2026-118726)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on an affected system.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening the file to execute arbitrary code on the affected system.

The Preview Pane is not an attack vector for this vulnerability.

71) Out-of-bounds read (CVE-ID: CVE-2026-118725)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges to those of the user account or service account running the affected process.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when processing a specially crafted workbook in Page Break Preview. A remote attacker can provide a crafted Excel workbook and convince a user to open it for editing, edit a cell, and drag a print-area boundary to gain the permissions of the user running Excel.

The Preview Pane is not an attack vector for this vulnerability.

72) Untrusted Pointer Dereference (CVE-ID: CVE-2026-118724)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the affected system.

The vulnerability exists due to untrusted pointer dereference in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code on the affected system.

The Preview Pane is not an attack vector for this vulnerability.

73) Untrusted Pointer Dereference (CVE-ID: CVE-2026-118723)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the victim's system.

The vulnerability exists due to an untrusted pointer dereference in Microsoft Office Excel when processing attacker-controlled input. A remote attacker can induce a user to process crafted input that triggers the invalid pointer dereference to execute arbitrary code on the victim's system.

The Preview Pane is not an attack vector for this vulnerability.

74) Heap-based buffer overflow (CVE-ID: CVE-2026-118722)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the affected system.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing specially crafted files. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

75) Heap-based buffer overflow (CVE-ID: CVE-2026-118721)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the permissions of the user running Excel.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a specially crafted workbook during formula entry. A remote attacker can send a specially crafted Excel workbook and convince a user to open it for editing and begin typing a formula to execute arbitrary code with that user's permissions.

The Preview Pane is not an attack vector for this vulnerability.

76) Heap-based buffer overflow (CVE-ID: CVE-2026-116927)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in the victim user's context.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a specially crafted file that a user opens and saves as a web page. A remote attacker can send such a file and convince a user to open it in Excel and save it as a web page to execute arbitrary code in the user's context.

The Preview Pane is not an attack vector for this vulnerability.

77) Double free (CVE-ID: CVE-2026-118719)

CWE-ID: CWE-415 - Double Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to double free in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

78) Heap-based buffer overflow (CVE-ID: CVE-2026-118718)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing row deletion in a specially crafted workbook. A remote attacker can convince a user to open the workbook and delete a row in it to execute arbitrary code with that user's privileges.

The Preview Pane is not an attack vector for this vulnerability.

79) Stack-based buffer overflow (CVE-ID: CVE-2026-118717)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a stack-based buffer overflow in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening the file to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

80) Use-after-free (CVE-ID: CVE-2026-118716)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the affected system.

The vulnerability exists due to use-after-free in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening the file to execute arbitrary code on the affected system.

The Preview Pane is not an attack vector for this vulnerability.

81) Heap-based buffer overflow (CVE-ID: CVE-2026-118715)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain the privileges of the user account or service account running the affected process.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a specially crafted Office file and convince a user to open it to gain the privileges of the account running the affected process.

The Preview Pane is not an attack vector for this vulnerability.

82) Heap-based buffer overflow (CVE-ID: CVE-2026-118714)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

83) Use-after-free (CVE-ID: CVE-2026-118713)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to use-after-free in Microsoft Office Excel when processing a specially crafted workbook. A remote attacker can convince a user to open the workbook and edit a cell in it to execute arbitrary code with that user's privileges.

The Preview Pane is not an attack vector.

84) Integer underflow (CVE-ID: CVE-2026-118712)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to integer underflow in Microsoft Office Excel when processing crafted input. A remote attacker can supply crafted input and induce a user to trigger its processing to execute arbitrary code.

The Preview Pane is not an exploitation vector.

85) Stack-based buffer overflow (CVE-ID: CVE-2026-118711)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to a stack-based buffer overflow in Microsoft Office Excel when processing a specially crafted workbook during cell editing. A remote attacker can convince a user to open the crafted workbook and edit a cell in it to execute arbitrary code with that user's privileges.

The Preview Pane is not an attack vector for this vulnerability.

Remediation

Install update from vendor's website.

SB2026111131 - Multiple vulnerabilities in Microsoft Office

Breakdown by Severity

Description

Remediation

References

Please verify you're human