Publisher (Microsoft) - vulnerabilities (CVEs)

45 CVEs, 0 in the last 30 days, 23 known versions, newest CVE from 2026-09-08. Vendor: Microsoft.

CVEs of Publisher

• CVE-2026-81385 - CVSS 8.8 (high), 2026-09-08: Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network.
• CVE-2026-69742 - CVSS 8.8 (high), 2026-09-08: Integer overflow or wraparound in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network.
• CVE-2024-38226 - CVSS 7.3 (high), 2024-09-10: Microsoft Publisher Security Feature Bypass Vulnerability
• CVE-2024-20673 - CVSS 7.8 (high), 2024-02-13: Microsoft Office Remote Code Execution Vulnerability
• CVE-2023-28287 - CVSS 7.8 (high), 2023-06-17: Microsoft Publisher Remote Code Execution Vulnerability
• CVE-2023-28295 - CVSS 7.8 (high), 2023-06-17: Microsoft Publisher Remote Code Execution Vulnerability
• CVE-2022-29107 - CVSS 5.5 (medium), 2022-05-10: Microsoft Office Security Feature Bypass Vulnerability
• CVE-2020-0760 - CVSS 8.8 (high), 2020-04-15: A remote code execution vulnerability exists when Microsoft Office improperly loads arbitrary type libraries, aka 'Microsoft Office Remote Code Execution…
• CVE-2018-8245 - CVSS 7.8 (high), 2018-06-14: A remote code execution vulnerability exists when Microsoft Publisher fails to utilize features that lock down the Local Machine zone when instantiating OLE…
• CVE-2017-8725 - CVSS 7.8 (high), 2017-09-13: A remote code execution vulnerability exists in Microsoft Publisher 2007 Service Pack 3 and Microsoft Publisher 2010 Service Pack 2 when they fail to properly…
• CVE-2016-7289 - CVSS 7.8 (high), 2016-12-20: Microsoft Publisher 2010 SP2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka…
• CVE-2015-2503 - CVSS 9.3 (critical), 2015-11-11: Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007 SP3,…
• CVE-2014-1759 - CVSS 9.3 (critical), 2014-04-08: pubconv.dll in Microsoft Publisher 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer…
• CVE-2013-1322 - CVSS 10 (critical), 2013-05-15: Microsoft Publisher 2003 SP3 does not properly check table range data, which allows remote attackers to execute arbitrary code via a crafted Publisher file,…
• CVE-2013-1328 - CVSS 9.3 (critical), 2013-05-15: Microsoft Publisher 2003 SP3, 2007 SP3, and 2010 SP1 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers incorrect…
• CVE-2013-1318 - CVSS 10 (critical), 2013-05-15: Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers access to an invalid pointer, aka…
• CVE-2013-1321 - CVSS 9.3 (critical), 2013-05-15: Microsoft Publisher 2003 SP3 does not properly check the data type of an unspecified return value, which allows remote attackers to execute arbitrary code via…
• CVE-2013-1327 - CVSS 9.3 (critical), 2013-05-15: Integer signedness error in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers an…
• CVE-2013-1317 - CVSS 9.3 (critical), 2013-05-15: Integer overflow in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers an improper…
• CVE-2013-1320 - CVSS 10 (critical), 2013-05-15: Buffer overflow in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Buffer Overflow…
• CVE-2013-1323 - CVSS 9.3 (critical), 2013-05-15: Microsoft Publisher 2003 SP3 does not properly handle NULL values for unspecified data items, which allows remote attackers to execute arbitrary code via a…
• CVE-2013-1329 - CVSS 9.3 (critical), 2013-05-15: Integer signedness error in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers a buffer…
• CVE-2013-1316 - CVSS 9.3 (critical), 2013-05-15: Microsoft Publisher 2003 SP3 does not properly validate the size of an unspecified array, which allows remote attackers to execute arbitrary code via a…
• CVE-2013-1319 - CVSS 10 (critical), 2013-05-15: Microsoft Publisher 2003 SP3 does not properly check the return value of an unspecified method, which allows remote attackers to execute arbitrary code via a…
• CVE-2011-1508 - CVSS 9.3 (critical), 2011-12-14: Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, does not properly manage memory allocations for function pointers, which allows user-assisted remote…
• CVE-2011-3412 - CVSS 9.3 (critical), 2011-12-14: Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, allows remote attackers to execute arbitrary code via a crafted Publisher file that leverages incorrect…
• CVE-2011-3411 - CVSS 9.3 (critical), 2011-12-14: Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that leverages incorrect handling of values in…
• CVE-2011-3410 - CVSS 9.3 (critical), 2011-12-14: Array index error in Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, allows remote attackers to execute arbitrary code via a crafted Publisher file that…
• CVE-2010-3955 - CVSS 9.3 (critical), 2010-12-16: pubconv.dll (aka the Publisher Converter DLL) in Microsoft Publisher 2002 SP3 does not properly perform array indexing, which allows remote attackers to…
• CVE-2010-3954 - CVSS 9.3 (critical), 2010-12-16: Microsoft Publisher 2002 SP3, 2003 SP3, and 2010 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a…
• CVE-2010-2571 - CVSS 9.3 (critical), 2010-12-16: Array index error in pubconv.dll (aka the Publisher Converter DLL) in Microsoft Publisher 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary…
• CVE-2010-2570 - CVSS 9.3 (critical), 2010-12-16: Heap-based buffer overflow in pubconv.dll (aka the Publisher Converter DLL) in Microsoft Publisher 2002 SP3, 2003 SP3, 2007 SP2, and 2010 allows remote…
• CVE-2010-2569 - CVSS 9.3 (critical), 2010-12-16: pubconv.dll (aka the Publisher Converter DLL) in Microsoft Publisher 2002 SP3, 2003 SP3, and 2007 SP2 does not properly handle an unspecified size field in…
• CVE-2010-0479 - CVSS 9.3 (critical), 2010-04-14: Buffer overflow in Microsoft Office Publisher 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted…
• CVE-2008-3068 - CVSS 7.5 (high), 2008-07-07: Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by…
• CVE-2008-0104 - CVSS 9.3 (critical), 2008-02-12: Unspecified vulnerability in Microsoft Office Publisher 2000, 2002, and 2003 SP2 allows remote attackers to execute arbitrary code via a crafted .pub file,…
• CVE-2008-0102 - CVSS 10 (critical), 2008-02-12: Unspecified vulnerability in Microsoft Office Publisher 2000, 2002, and 2003 SP2 allows remote attackers to execute arbitrary code via a crafted .pub file,…
• CVE-2007-6534 - CVSS 6.8 (medium), 2007-12-27: Multiple unspecified vulnerabilities in Microsoft Office Publisher allow user-assisted remote attackers to cause a denial of service (application crash) via a…
• CVE-2007-1754 - CVSS 9.3 (critical), 2007-07-10: PUBCONV.DLL in Microsoft Office Publisher 2007 does not properly clear memory when transferring data from disk to memory, which allows user-assisted remote…
• CVE-2007-1117 - CVSS 10 (critical), 2007-02-27: Unspecified vulnerability in Publisher 2007 in Microsoft Office 2007 allows remote attackers to execute arbitrary code via unspecified vectors, related to a…
• CVE-2007-0671 - CVSS 8.8 (high), 2007-02-03: Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to…
• CVE-2006-3877 - CVSS 9.3 (critical), 2006-10-10: Unspecified vulnerability in PowerPoint in Microsoft Office 2000, Office 2002, Office 2003, Office 2004 for Mac, and Office v.X for Mac allows user-assisted…
• CVE-2006-0001 - CVSS 9.3 (critical), 2006-09-12: Stack-based buffer overflow in Microsoft Publisher 2000 through 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted PUB file,…
• CVE-2004-0573 - CVSS 7.5 (high), 2004-09-28: Buffer overflow in the converter for Microsoft WordPerfect 5.x on Office 2000, Office XP, Office 2003, and Works Suites 2001 through 2004 allows remote…
• CVE-2004-0200 - CVSS 9.3 (critical), 2004-09-28: Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to…