What happened
CVE-2026-118732 is a use-after-free vulnerability (CWE-416) in Microsoft Office Excel. It allows an unauthorised attacker to execute code over a network. Exploitation requires no prior access, but does require a person to act, such as opening a file or visiting a page. The attack path is remotely delivered content that a person opens; the issue is not an exposed network service. The severity is high, with an NVD score of 8.8. NVD analysis is still in progress, so the scope may change. A fix is available. The affected-version details supplied for Microsoft 365 Apps for Enterprise refer to the vendor’s Office Security Releases information.
Who is affected
Affected deployments include Microsoft 365 Apps for Enterprise (32-bit and x64), Microsoft Office 365 for Mac, Microsoft Office LTSC 2021 (32-bit and x64), Microsoft Office LTSC 2024 (32-bit and x64), Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. The stated affected ranges are: Microsoft 365 Apps for Enterprise, 16.0.1 to before <code>https://aka.ms/OfficeSecurityReleases</code>; Microsoft Office 365 for Mac, 1.0.0 to before 16.115.26110837; Office LTSC 2021 and Office LTSC for Mac 2021, 16.0.1 to before 16.0.14334.21048 and 16.115.26110837 respectively; Office LTSC 2024 and Office LTSC for Mac 2024, 16.0.0 to before 16.0.17932.21140 and 16.115.26110837 respectively.
Recommended actions
- Apply the available fix to affected deployments, and check the vendor advisory for fixed versions.
- Restrict or filter mail and web content that could deliver untrusted files or pages.
- Block or sandbox affected file types before they are opened.
- Reduce the attack surface of software used to open untrusted content.
- Raise user awareness of the risk of opening unexpected files or visiting untrusted pages.
