With its monthly security update released on November 10, 2026, Microsoft closed a total of 134 remote code execution (RCE) vulnerabilities across the Office family. This month, the company’s Security Response Center (MSRC) catalog lists 1,362 vulnerabilities and 243 product entries. The breakdown is as follows: Excel 53, Word 58, Outlook 18, PowerPoint 5 RCE entries.
In Excel, just opening the file is enough
One of the vulnerabilities is CVE-2026-118292. According to the MSRC entry, Excel has a stack-based buffer overflow with a CVSS 3.1 score of 8.8. An attacker convinces the victim to open a specially crafted workbook and save it in a different file format; code can then be executed during that process. The preview pane is not an attack vector for this flaw, so the file actually has to be opened. Among the 58 RCE entries on the Word side, the highest score is also 8.8.
In PowerPoint, even preview is a risk
The PowerPoint vulnerability tracked as CVE-2026-120001 is a heap-based buffer overflow, again with a score of 8.8. The key distinction here is critical: MSRC says the preview pane is an attack vector for this flaw. In other words, without even opening the file, simply selecting it can be enough. The issue is triggered by adding a specially crafted audio file to the presentation.
Email and the Windows side
Outlook has 18 RCE entries. CVE-2026-123375 depends on opening a specially crafted attachment and has a score of 8.8. On the Windows side, Microsoft also patched a 9.8-rated RCE in the Windows Search component (CVE-2026-116928) and a 7.8-rated elevation of privilege flaw (CVE-2026-119954). In the latter, an attacker can gain SYSTEM privileges through absolute path traversal; a logged-in user account is required. The patch number is KB5131085. For the Windows Search RCE, versions KB5132061 and KB5132043 were released; the records also show Windows 11 26H2 among the affected systems.
What should you do?
Microsoft 365 subscribers receive the update automatically, but you should still verify in Office apps that the updated version is installed via File > Account > Update Options. Office 2021 and 2024 LTSC users need to install the monthly security update through Microsoft Update. Those using Office on Mac should update via Microsoft AutoUpdate. On Windows, it’s worth checking whether KB5131085, KB5132061, and KB5132043 are installed.
File-opening habits are the weakest link in these vulnerabilities. Before opening Excel, Word, and PowerPoint files from unfamiliar sources, think twice; with PowerPoint files, even passing through the preview pane carries risk.
Source: Microsoft MSRC
Share your experience
Bir sorunun, farklı bir çözümün veya eklemek istediğin bir notun var mı? Giriş yapmadan da yazabilirsin.