Microsoft 365 Apps — known CVE vulnerabilities

Every CVE whose affected-product data names Microsoft 365 Apps, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (200)

• CVE-2023-23397 — CVSS 9.8 (critical) — actively exploited: Microsoft Outlook Elevation of Privilege Vulnerability
• CVE-2020-0901 — CVSS 9.8 (critical): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka…
• CVE-2024-21413 — CVSS 9.8 (critical) — actively exploited: Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2023-33150 — CVSS 9.6 (critical): Microsoft Office Security Feature Bypass Vulnerability
• CVE-2024-30103 — CVSS 8.8 (high): Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2022-34717 — CVSS 8.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2020-1447 — CVSS 8.8 (high): A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft…
• CVE-2026-40420 — CVSS 8.8 (high): Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
• CVE-2020-1240 — CVSS 8.8 (high): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka…
• CVE-2026-35436 — CVSS 8.8 (high): Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
• CVE-2024-21378 — CVSS 8.8 (high): Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2020-1494 — CVSS 8.8 (high): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An…
• CVE-2024-38189 — CVSS 8.8 (high) — actively exploited: Microsoft Project Remote Code Execution Vulnerability
• CVE-2024-38021 — CVSS 8.8 (high): Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2022-41106 — CVSS 8.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2020-1225 — CVSS 8.8 (high): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka…
• CVE-2020-1321 — CVSS 8.8 (high): A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory, aka…
• CVE-2020-1495 — CVSS 8.8 (high): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An…
• CVE-2023-35311 — CVSS 8.8 (high) — actively exploited: Microsoft Outlook Security Feature Bypass Vulnerability
• CVE-2020-1583 — CVSS 8.8 (high): An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who…
• CVE-2020-1498 — CVSS 8.8 (high): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An…
• CVE-2020-1226 — CVSS 8.8 (high): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka…
• CVE-2020-1496 — CVSS 8.8 (high): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An…
• CVE-2021-28455 — CVSS 8.8 (high): Microsoft Jet Red Database Engine and Access Connectivity Engine Remote Code Execution Vulnerability
• CVE-2020-1446 — CVSS 8.8 (high): A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft…
• CVE-2025-21354 — CVSS 8.4 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2025-62554 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45461 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45472 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-59236 — CVSS 8.4 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-45458 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-54910 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-53784 — CVSS 8.4 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-40364 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code…
• CVE-2026-40363 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-26110 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-53740 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-40361 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-53733 — CVSS 8.4 (high): Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2023-36569 — CVSS 8.4 (high): Microsoft Office Elevation of Privilege Vulnerability
• CVE-2025-53731 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-49697 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-40358 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-26109 — CVSS 8.4 (high): Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-49695 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-47957 — CVSS 8.4 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-47953 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-20953 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-20952 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-33115 — CVSS 8.4 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-47167 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-20944 — CVSS 8.4 (high): Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-47164 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-47162 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-33114 — CVSS 8.4 (high): Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-32717 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-32704 — CVSS 8.4 (high): Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-30386 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-40367 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code…
• CVE-2026-40366 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code…
• CVE-2025-30377 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-62557 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-32190 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45463 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-21362 — CVSS 8.4 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2026-45474 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-26113 — CVSS 8.4 (high): Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-49696 — CVSS 8.4 (high): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45456 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2021-34469 — CVSS 8.2 (high): Microsoft Office Security Feature Bypass Vulnerability
• CVE-2026-44822 — CVSS 8.2 (high): Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
• CVE-2023-36897 — CVSS 8.1 (high): Visual Studio Tools for Office Runtime Spoofing Vulnerability
• CVE-2021-40480 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2021-40485 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-42292 — CVSS 7.8 (high) — actively exploited: Microsoft Excel Security Feature Bypass Vulnerability
• CVE-2021-42296 — CVSS 7.8 (high): Microsoft Word Remote Code Execution Vulnerability
• CVE-2021-43256 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2022-21841 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2022-21988 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2022-22003 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2022-22004 — CVSS 7.8 (high): Microsoft Office ClickToRun Remote Code Execution Vulnerability
• CVE-2022-24461 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2022-24473 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2022-24509 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2022-24510 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2022-26804 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2022-26805 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2022-26806 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2022-26901 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2022-29109 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2022-30174 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2022-37962 — CVSS 7.8 (high): Microsoft PowerPoint Remote Code Execution Vulnerability
• CVE-2022-37963 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2022-38010 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2022-38048 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2022-38049 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2022-41031 — CVSS 7.8 (high): Microsoft Word Remote Code Execution Vulnerability
• CVE-2022-41061 — CVSS 7.8 (high): Microsoft Word Remote Code Execution Vulnerability
• CVE-2022-41063 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2022-41107 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2022-44691 — CVSS 7.8 (high): Microsoft Office OneNote Remote Code Execution Vulnerability
• CVE-2022-44692 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2022-44694 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2022-44695 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2022-44696 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2022-47211 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2022-47212 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2022-47213 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2023-21734 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2023-21735 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2023-21736 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2023-21737 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2023-21738 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2023-23399 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2023-24953 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2023-28285 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2023-28287 — CVSS 7.8 (high): Microsoft Publisher Remote Code Execution Vulnerability
• CVE-2023-28295 — CVSS 7.8 (high): Microsoft Publisher Remote Code Execution Vulnerability
• CVE-2023-28311 — CVSS 7.8 (high): Microsoft Word Remote Code Execution Vulnerability
• CVE-2023-29344 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2023-32029 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2023-33133 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2023-33146 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2023-33148 — CVSS 7.8 (high): Microsoft Office Elevation of Privilege Vulnerability
• CVE-2023-33149 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2021-43875 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2020-1193 — CVSS 7.8 (high): <p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory…
• CVE-2020-1218 — CVSS 7.8 (high): <p>A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker…
• CVE-2020-1332 — CVSS 7.8 (high): <p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory…
• CVE-2020-1335 — CVSS 7.8 (high): <p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory…
• CVE-2020-1338 — CVSS 7.8 (high): <p>A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker…
• CVE-2020-1349 — CVSS 7.8 (high): A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka…
• CVE-2020-1449 — CVSS 7.8 (high): A remote code execution vulnerability exists in Microsoft Project software when the software fails to check the source markup of a file…
• CVE-2020-1458 — CVSS 7.8 (high): A remote code execution vulnerability exists when Microsoft Office improperly validates input before loading dynamic link library (DLL)…
• CVE-2020-1563 — CVSS 7.8 (high): A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An…
• CVE-2020-1581 — CVSS 7.8 (high): An elevation of privilege vulnerability exists in the way that Microsoft Office Click-to-Run (C2R) components handle objects in memory. An…
• CVE-2020-1582 — CVSS 7.8 (high): A remote code execution vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory. An…
• CVE-2020-1594 — CVSS 7.8 (high): <p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory…
• CVE-2020-16918 — CVSS 7.8 (high): <p>A remote code execution vulnerability exists when the Base3D rendering engine improperly handles memory.</p> <p>An attacker who…
• CVE-2020-16928 — CVSS 7.8 (high): <p>An elevation of privilege vulnerability exists in the way that Microsoft Office Click-to-Run (C2R) AppVLP handles certain files. An…
• CVE-2020-16929 — CVSS 7.8 (high): <p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory…
• CVE-2020-16930 — CVSS 7.8 (high): <p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory…
• CVE-2020-16931 — CVSS 7.8 (high): <p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory…
• CVE-2020-16932 — CVSS 7.8 (high): <p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory…
• CVE-2020-16954 — CVSS 7.8 (high): <p>A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory…
• CVE-2020-16955 — CVSS 7.8 (high): <p>An elevation of privilege vulnerability exists in the way that Microsoft Office Click-to-Run (C2R) AppVLP handles certain files. An…
• CVE-2020-16957 — CVSS 7.8 (high): <p>A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory…
• CVE-2020-17062 — CVSS 7.8 (high): Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
• CVE-2020-17064 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2020-17065 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2020-17067 — CVSS 7.8 (high): Microsoft Excel Security Feature Bypass Vulnerability
• CVE-2020-17123 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2020-17124 — CVSS 7.8 (high): Microsoft PowerPoint Remote Code Execution Vulnerability
• CVE-2020-17125 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2020-17128 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2020-17129 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-1711 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2021-1713 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-1714 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-1715 — CVSS 7.8 (high): Microsoft Word Remote Code Execution Vulnerability
• CVE-2021-1716 — CVSS 7.8 (high): Microsoft Word Remote Code Execution Vulnerability
• CVE-2021-24067 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-24069 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-24070 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-24108 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2021-27053 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-27054 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-27056 — CVSS 7.8 (high): Microsoft PowerPoint Remote Code Execution Vulnerability
• CVE-2021-27057 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2021-27058 — CVSS 7.8 (high): Microsoft Office ClickToRun Remote Code Execution Vulnerability
• CVE-2021-28449 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2021-28451 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-28453 — CVSS 7.8 (high): Microsoft Word Remote Code Execution Vulnerability
• CVE-2021-28454 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-31175 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2021-31176 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2021-31177 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2021-31179 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2021-31180 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2021-31939 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-31940 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2021-31941 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2021-34452 — CVSS 7.8 (high): Microsoft Word Remote Code Execution Vulnerability
• CVE-2021-34478 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2021-34501 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-36941 — CVSS 7.8 (high): Microsoft Word Remote Code Execution Vulnerability
• CVE-2021-38646 — CVSS 7.8 (high) — actively exploited: Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
• CVE-2021-38653 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2021-38654 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2021-38655 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-38656 — CVSS 7.8 (high): Microsoft Word Remote Code Execution Vulnerability
• CVE-2021-38659 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2021-40442 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-40471 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-40473 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-40474 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-40479 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2025-27748 — CVSS 7.8 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-27749 — CVSS 7.8 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-27750 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.