Office (Microsoft) - vulnerabilities (CVEs)

1054 CVEs, 2 in the last 30 days, 195 known versions, newest CVE from 2026-10-13. Vendor: Microsoft.

CVEs of Office

• CVE-2026-85881 - CVSS 8 (high), 2026-10-13: Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.
• CVE-2026-105731 - CVSS 5.5 (medium), 2026-10-13: Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally.
• CVE-2026-78439 - CVSS 8.8 (high), 2026-09-08: Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
• CVE-2026-70105 - CVSS 7.5 (high), 2026-08-20: Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
• CVE-2026-62877 - CVSS 7.8 (high), 2026-08-11: Stack-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.
• CVE-2026-62740 - CVSS 5.5 (medium), 2026-08-11: Use of uninitialized resource in Windows Imaging Component allows an authorized attacker to disclose information locally.
• CVE-2026-57084 - CVSS 5.5 (medium), 2026-07-14: Use of uninitialized resource in Windows File Explorer allows an unauthorized attacker to disclose information locally.
• CVE-2026-57083 - CVSS 5.5 (medium), 2026-07-14: Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized attacker to disclose information locally.
• CVE-2026-56176 - CVSS 7.8 (high), 2026-07-14: Out-of-bounds read in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
• CVE-2026-55054 - CVSS 6.5 (medium), 2026-07-14: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
• CVE-2026-50387 - CVSS 7.8 (high), 2026-07-14: Stack-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.
• CVE-2026-47293 - CVSS 7 (high), 2026-06-09: Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
• CVE-2026-45474 - CVSS 8.4 (high), 2026-06-09: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45472 - CVSS 8.4 (high), 2026-06-09: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45463 - CVSS 8.4 (high), 2026-06-09: Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45461 - CVSS 8.4 (high), 2026-06-09: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45460 - CVSS 4.7 (medium), 2026-06-09: Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-42832 - CVSS 7.7 (high), 2026-05-12: Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.
• CVE-2026-42831 - CVSS 7.8 (high), 2026-05-12: Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-40420 - CVSS 8.8 (high), 2026-05-12: Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
• CVE-2026-40419 - CVSS 7.8 (high), 2026-05-12: Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
• CVE-2026-40421 - CVSS 4.3 (medium), 2026-05-12: Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
• CVE-2026-40418 - CVSS 7.8 (high), 2026-05-12: Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
• CVE-2026-40363 - CVSS 8.4 (high), 2026-05-12: Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-40367 - CVSS 8.4 (high), 2026-05-12: Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-40362 - CVSS 7.8 (high), 2026-05-12: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-40366 - CVSS 8.4 (high), 2026-05-12: Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-40364 - CVSS 8.4 (high), 2026-05-12: Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-40359 - CVSS 7.8 (high), 2026-05-12: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-40358 - CVSS 8.4 (high), 2026-05-12: Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-40361 - CVSS 8.4 (high), 2026-05-12: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-35440 - CVSS 5.5 (medium), 2026-05-12: Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
• CVE-2026-40360 - CVSS 7.8 (high), 2026-05-12: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
• CVE-2026-35436 - CVSS 8.8 (high), 2026-05-12: Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
• CVE-2026-32198 - CVSS 7.8 (high), 2026-04-14: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-32197 - CVSS 7.8 (high), 2026-04-14: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-32200 - CVSS 7.8 (high), 2026-04-14: Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
• CVE-2026-32199 - CVSS 7.8 (high), 2026-04-14: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-32190 - CVSS 8.4 (high), 2026-04-14: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-32189 - CVSS 7.8 (high), 2026-04-14: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-32188 - CVSS 7.1 (high), 2026-04-14: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
• CVE-2026-26134 - CVSS 7.8 (high), 2026-03-10: Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally.
• CVE-2026-26113 - CVSS 8.4 (high), 2026-03-10: Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-26108 - CVSS 7.8 (high), 2026-03-10: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-26112 - CVSS 7.8 (high), 2026-03-10: Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-26110 - CVSS 8.4 (high), 2026-03-10: Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-26109 - CVSS 8.4 (high), 2026-03-10: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-26107 - CVSS 7.8 (high), 2026-03-10: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-25180 - CVSS 5.5 (medium), 2026-03-10: Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally.
• CVE-2026-24285 - CVSS 7 (high), 2026-03-10: Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
• CVE-2026-21511 - CVSS 7.5 (high), 2026-02-10: Deserialization of untrusted data in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
• CVE-2026-21261 - CVSS 5.5 (medium), 2026-02-10: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
• CVE-2026-21260 - CVSS 7.5 (high), 2026-02-10: Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
• CVE-2026-21259 - CVSS 7.8 (high), 2026-02-10: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to elevate privileges locally.
• CVE-2026-21258 - CVSS 5.5 (medium), 2026-02-10: Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
• CVE-2026-20846 - CVSS 7.5 (high), 2026-02-10: Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network.
• CVE-2026-21509 - CVSS 7.8 (high), 2026-01-26: Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.
• CVE-2026-20955 - CVSS 7.8 (high), 2026-01-13: Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-20953 - CVSS 8.4 (high), 2026-01-13: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-20957 - CVSS 7.8 (high), 2026-01-13: Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-20948 - CVSS 7.8 (high), 2026-01-13: Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-20946 - CVSS 7.8 (high), 2026-01-13: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-20952 - CVSS 8.4 (high), 2026-01-13: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-20950 - CVSS 7.8 (high), 2026-01-13: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-20943 - CVSS 7 (high), 2026-01-13: Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-62564 - CVSS 7.8 (high), 2025-12-09: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-62563 - CVSS 7.8 (high), 2025-12-09: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-62562 - CVSS 7.8 (high), 2025-12-09: Use after free in Microsoft Office Outlook allows an unauthorized attacker to execute code locally.
• CVE-2025-62558 - CVSS 7.8 (high), 2025-12-09: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-62561 - CVSS 7.8 (high), 2025-12-09: Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-62557 - CVSS 8.4 (high), 2025-12-09: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-62560 - CVSS 7.8 (high), 2025-12-09: Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-62559 - CVSS 7.8 (high), 2025-12-09: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-62555 - CVSS 7 (high), 2025-12-09: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-62554 - CVSS 8.4 (high), 2025-12-09: Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-62553 - CVSS 7.8 (high), 2025-12-09: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-62556 - CVSS 7.8 (high), 2025-12-09: Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-62552 - CVSS 7.8 (high), 2025-12-09: Relative path traversal in Microsoft Office Access allows an unauthorized attacker to execute code locally.
• CVE-2025-62200 - CVSS 7.8 (high), 2025-11-11: Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-62203 - CVSS 7.8 (high), 2025-11-11: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-62199 - CVSS 7.8 (high), 2025-11-11: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-62202 - CVSS 7.1 (high), 2025-11-11: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
• CVE-2025-62201 - CVSS 7.8 (high), 2025-11-11: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-60726 - CVSS 7.1 (high), 2025-11-11: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
• CVE-2025-60724 - CVSS 9.8 (critical), 2025-11-11: Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
• CVE-2025-60727 - CVSS 7.8 (high), 2025-11-11: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-59240 - CVSS 5.5 (medium), 2025-11-11: Exposure of sensitive information to an unauthorized actor in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
• CVE-2025-59234 - CVSS 7.8 (high), 2025-10-14: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-59238 - CVSS 7.8 (high), 2025-10-14: Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
• CVE-2025-59236 - CVSS 8.4 (high), 2025-10-14: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-59235 - CVSS 7.1 (high), 2025-10-14: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
• CVE-2025-59233 - CVSS 7.8 (high), 2025-10-14: Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-59232 - CVSS 7.1 (high), 2025-10-14: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
• CVE-2025-59231 - CVSS 7.8 (high), 2025-10-14: Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-59227 - CVSS 7.8 (high), 2025-10-14: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-59225 - CVSS 7.8 (high), 2025-10-14: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-59223 - CVSS 7.8 (high), 2025-10-14: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-59222 - CVSS 7.8 (high), 2025-10-14: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-59221 - CVSS 7 (high), 2025-10-14: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-59224 - CVSS 7.8 (high), 2025-10-14: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.