Office
by Microsoft
CVEs (1,301)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-38189 | Hig | 0.70 | 8.8 | 0.08 | KEV | Aug 13, 2024 | Microsoft Project Remote Code Execution Vulnerability | |
| CVE-2023-35311 | Hig | 0.70 | 8.8 | 0.16 | KEV | Jul 11, 2023 | Microsoft Outlook Security Feature Bypass Vulnerability | |
| CVE-2023-21716 | Cri | 0.70 | 9.8 | 0.82 | Feb 14, 2023 | Microsoft Word Remote Code Execution Vulnerability | ||
| CVE-2018-0802 | Hig | 0.70 | 7.8 | 0.87 | KEV | Jan 10, 2018 | Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique… | |
| CVE-2015-2545 | Hig | 0.70 | 7.8 | 0.80 | KEV | Sep 9, 2015 | Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted EPS image, aka "Microsoft Office Malformed EPS File Vulnerability." | |
| CVE-2015-1641 | Hig | 0.70 | 7.8 | 0.93 | KEV | Apr 14, 2015 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote… | |
| CVE-2021-38646 | Hig | 0.69 | 7.8 | 0.08 | KEV | Sep 15, 2021 | Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability | |
| CVE-2017-0262 | Hig | 0.69 | 7.8 | 0.81 | KEV | May 12, 2017 | Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0261 and CVE-2017-0281. | |
| CVE-2017-0261 | Hig | 0.69 | 7.8 | 0.78 | KEV | May 12, 2017 | Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0262 and CVE-2017-0281. | |
| CVE-2016-7182 | Cri | 0.69 | 9.8 | 0.30 | Oct 14, 2016 | The Graphics component in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; Office 2007 SP3; Office 2010 SP2; Word Viewer; Skype for Business 2016; Lync… | ||
| CVE-2013-1331 | Hig | 0.69 | 7.8 | 0.82 | KEV | Jun 12, 2013 | Buffer overflow in Microsoft Office 2003 SP3 and Office 2011 for Mac allows remote attackers to execute arbitrary code via crafted PNG data in an Office document, leading to improper memory allocation, aka "Office Buffer Overflow Vulnerability." | |
| CVE-2026-21509 | Hig | 0.68 | 7.8 | 0.72 | KEV | Jan 26, 2026 | Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally. | |
| CVE-2009-0563 | Hig | 0.68 | 7.8 | 0.63 | KEV | Jun 10, 2009 | Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word Viewer 2003 SP3; Microsoft Office Word Viewer; and Microsoft Office Compatibility… | |
| CVE-2017-11774 | Hig | 0.67 | 7.8 | 0.60 | KEV | Oct 13, 2017 | Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability." | |
| CVE-2016-7193 | Hig | 0.67 | 7.8 | 0.58 | KEV | Oct 14, 2016 | Microsoft Word 2007 SP2, Office 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1,… | |
| CVE-2015-1642 | Hig | 0.67 | 7.8 | 0.53 | KEV | Aug 15, 2015 | Microsoft Office 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." | |
| CVE-2009-0557 | Hig | 0.67 | 7.8 | 0.59 | KEV | Jun 10, 2009 | Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; and Microsoft… | |
| CVE-2021-42292 | Hig | 0.65 | 7.8 | 0.32 | KEV | Nov 10, 2021 | Microsoft Excel Security Feature Bypass Vulnerability | |
| CVE-2020-0901 | Cri | 0.65 | 9.8 | 0.12 | May 21, 2020 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. | ||
| CVE-2025-60724 | Cri | 0.64 | 9.8 | 0.06 | Nov 11, 2025 | Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. |
- risk 0.70cvss 8.8epss 0.08
Microsoft Project Remote Code Execution Vulnerability
- risk 0.70cvss 8.8epss 0.16
Microsoft Outlook Security Feature Bypass Vulnerability
- risk 0.70cvss 9.8epss 0.82
Microsoft Word Remote Code Execution Vulnerability
- risk 0.70cvss 7.8epss 0.87
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique…
- risk 0.70cvss 7.8epss 0.80
Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted EPS image, aka "Microsoft Office Malformed EPS File Vulnerability."
- risk 0.70cvss 7.8epss 0.93
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote…
- risk 0.69cvss 7.8epss 0.08
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
- risk 0.69cvss 7.8epss 0.81
Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0261 and CVE-2017-0281.
- risk 0.69cvss 7.8epss 0.78
Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0262 and CVE-2017-0281.
- risk 0.69cvss 9.8epss 0.30
The Graphics component in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; Office 2007 SP3; Office 2010 SP2; Word Viewer; Skype for Business 2016; Lync…
- risk 0.69cvss 7.8epss 0.82
Buffer overflow in Microsoft Office 2003 SP3 and Office 2011 for Mac allows remote attackers to execute arbitrary code via crafted PNG data in an Office document, leading to improper memory allocation, aka "Office Buffer Overflow Vulnerability."
- risk 0.68cvss 7.8epss 0.72
Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.
- risk 0.68cvss 7.8epss 0.63
Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word Viewer 2003 SP3; Microsoft Office Word Viewer; and Microsoft Office Compatibility…
- risk 0.67cvss 7.8epss 0.60
Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."
- risk 0.67cvss 7.8epss 0.58
Microsoft Word 2007 SP2, Office 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1,…
- risk 0.67cvss 7.8epss 0.53
Microsoft Office 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."
- risk 0.67cvss 7.8epss 0.59
Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; and Microsoft…
- risk 0.65cvss 7.8epss 0.32
Microsoft Excel Security Feature Bypass Vulnerability
- risk 0.65cvss 9.8epss 0.12
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.
- risk 0.64cvss 9.8epss 0.06
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
Page 2 of 66