CVE-2026-120790

HighCVSS 8.8/10Last modified Nov 10, 2026

Description

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-1207918.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1207927.3Insertion of sensitive information into log file in Aspire allows an authorized attacker to disclose information locally.CVE-2026-1207965.3Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-12084.3The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.CVE-2026-120807.3A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys cCVE-2026-1208037.1A use-after-free issue exists in MongoDB’s SBE (Slot-Based Execution) implementation of a window function accumulator used by certain $setWiCVE-2026-1208047.5A flaw exists in the server-side SSPI Kerberos authentication handler on Windows Enterprise builds of MongoDB. When processing certain autheCVE-2026-1208054.3In MongoDB Server, an authenticated user with insert privileges on a collection could craft a command with specially constructed encryption-CVE-2026-1208065.5A flaw in MongoDB Server's user management commands may lead to incomplete cleanup of role authorization data when roles are dropped from a CVE-2026-1208076.6A flaw in MongoDB’s X.509 cluster-membership authentication guard could allow a holder of a cluster-member certificate to gain elevated inteCVE-2026-1208087.4An issue exists in MongoDB's macOS TLS client implementation where certificate chain-of-trust validation is bypassed for outbound connectionCVE-2026-1208096.8A use-after-free read issue exists in MongoDB’s SBE (Slot-Based Execution) engine when processing aggregation pipelines with $unwind on time
CVE-2026-120790: High severity, CVSS 8.8 | Vulnix