Microsoft Office
1048 CVEs affecting Microsoft Office. Latest disclosed: 2026-07-14. Critical: 12, High: 571.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-60724 | Critical | 9.8 | 2025-11-11 | Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. |
CVE-2025-53766 | Critical | 9.8 | 2025-08-12 | Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network. |
CVE-2023-23397 | Critical | 9.8 | 2023-03-14 | Microsoft Outlook Elevation of Privilege Vulnerability |
CVE-2023-21716 | Critical | 9.8 | 2023-02-14 | Microsoft Word Remote Code Execution Vulnerability |
CVE-2020-0901 | Critical | 9.8 | 2020-05-21 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem… |
CVE-2019-1449 | Critical | 9.8 | 2019-11-12 | A security feature bypass vulnerability exists in the way that Office Click-to-Run (C2R) components handle a specially crafted file, which could lead to a stan… |
CVE-2019-1205 | Critical | 9.8 | 2019-08-14 | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfully exploi… |
CVE-2016-7182 | Critical | 9.8 | 2016-10-14 | The Graphics component in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows… |
CVE-2008-0081 | Critical | 9.8 | 2008-01-16 | Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows user-assisted remote attackers to execute a… |
CVE-2023-33150 | Critical | 9.6 | 2023-07-11 | Microsoft Office Security Feature Bypass Vulnerability |
CVE-2016-7277 | Critical | 9.6 | 2016-12-20 | Microsoft Office 2016 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft… |
CVE-2019-1109 | Critical | 9.1 | 2019-07-15 | A spoofing vulnerability exists when Microsoft Office Javascript does not check the validity of the web page making a request to Office documents.An attacker w… |
CVE-2026-40420 | High | 8.8 | 2026-05-12 | Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally. |
CVE-2026-35436 | High | 8.8 | 2026-05-12 | Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally. |
CVE-2024-38021 | High | 8.8 | 2024-07-09 | Microsoft Outlook Remote Code Execution Vulnerability |
CVE-2024-30103 | High | 8.8 | 2024-06-11 | Microsoft Outlook Remote Code Execution Vulnerability |
CVE-2024-21378 | High | 8.8 | 2024-02-13 | Microsoft Outlook Remote Code Execution Vulnerability |
CVE-2023-35311 | High | 8.8 | 2023-07-11 | Microsoft Outlook Security Feature Bypass Vulnerability |
CVE-2023-33131 | High | 8.8 | 2023-06-14 | Microsoft Outlook Remote Code Execution Vulnerability |
CVE-2022-41106 | High | 8.8 | 2022-11-09 | Microsoft Excel Remote Code Execution Vulnerability |