CVE-2026-118294
A NVD · · CVE-2026-118294
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key metrics
- CVSS
- 8.8
- EPSS
- 0%
Key insight
The NVD entry provides only a brief CVE description; details on exploitation, affected versions, or severity are missing, so it adds no value beyond patch information.
Description
CVE-2026-118294 describes a heap-based buffer overflow in Microsoft Office Excel. A non-authorized attacker can execute code over the network. The NVD entry provides no information on affected versions, CVSS severity, exploitation status, or public exploits. There are no indications of active exploitation or CISA KEV inclusion. It is therefore a pure vulnerability disclosure without confirmed attack context.
Risk score
- cvss base
- 88.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 88.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
Path: operational
MITRE ATT&CK mapping
1 TTPProcedure details
| Technique | Tactic | Procedure | Conf. | Source |
|---|---|---|---|---|
| T1203 Exploitation for Client Execution | Execution | Attacker exploits a heap-based buffer overflow in Microsoft Office Excel to execute arbitrary code when a victim opens a maliciously crafted file. | high | llm |