Microsoft 365 Apps — known CVE vulnerabilities

Every CVE whose affected-product data names Microsoft 365 Apps, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (200)

• CVE-2023-23397 — CVSS 9.8 (critical) — actively exploited: Microsoft Outlook Elevation of Privilege Vulnerability
• CVE-2026-78509 — CVSS 9.8 (critical): Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
• CVE-2020-0901 — CVSS 9.8 (critical): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An…
• CVE-2024-21413 — CVSS 9.8 (critical) — actively exploited: Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2023-33150 — CVSS 9.6 (critical): Microsoft Office Security Feature Bypass Vulnerability
• CVE-2026-78504 — CVSS 8.8 (high): Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2020-1495 — CVSS 8.8 (high): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An…
• CVE-2026-69767 — CVSS 8.8 (high): Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
• CVE-2026-78514 — CVSS 8.8 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2026-69764 — CVSS 8.8 (high): Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2026-78512 — CVSS 8.8 (high): Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2026-69759 — CVSS 8.8 (high): Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2022-34717 — CVSS 8.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2026-72973 — CVSS 8.8 (high): Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2026-69742 — CVSS 8.8 (high): Integer overflow or wraparound in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network.
• CVE-2020-1321 — CVSS 8.8 (high): A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory, aka…
• CVE-2026-69722 — CVSS 8.8 (high): Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2026-78526 — CVSS 8.8 (high): Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2026-78525 — CVSS 8.8 (high): Use after free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
• CVE-2026-77901 — CVSS 8.8 (high): Null pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2026-40420 — CVSS 8.8 (high): Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
• CVE-2026-69442 — CVSS 8.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
• CVE-2026-70329 — CVSS 8.8 (high): Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
• CVE-2024-38189 — CVSS 8.8 (high) — actively exploited: Microsoft Project Remote Code Execution Vulnerability
• CVE-2024-21378 — CVSS 8.8 (high): Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2026-78511 — CVSS 8.8 (high): Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2020-1494 — CVSS 8.8 (high): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An…
• CVE-2026-78519 — CVSS 8.8 (high): Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
• CVE-2023-35311 — CVSS 8.8 (high) — actively exploited: Microsoft Outlook Security Feature Bypass Vulnerability
• CVE-2021-28455 — CVSS 8.8 (high): Microsoft Jet Red Database Engine and Access Connectivity Engine Remote Code Execution Vulnerability
• CVE-2026-69686 — CVSS 8.8 (high): Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2026-69285 — CVSS 8.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
• CVE-2026-78507 — CVSS 8.8 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2026-69678 — CVSS 8.8 (high): Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
• CVE-2026-69671 — CVSS 8.8 (high): Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2026-78524 — CVSS 8.8 (high): Out-of-bounds write in Microsoft Office allows an unauthorized attacker to execute code over a network.
• CVE-2026-80085 — CVSS 8.8 (high): Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2026-81952 — CVSS 8.8 (high): Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2026-65807 — CVSS 8.8 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code…
• CVE-2026-78505 — CVSS 8.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
• CVE-2020-1225 — CVSS 8.8 (high): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka…
• CVE-2026-62870 — CVSS 8.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-72972 — CVSS 8.8 (high): Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2026-69629 — CVSS 8.8 (high): Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
• CVE-2026-69614 — CVSS 8.8 (high): Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
• CVE-2022-41106 — CVSS 8.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2020-1498 — CVSS 8.8 (high): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An…
• CVE-2020-1583 — CVSS 8.8 (high): An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who…
• CVE-2020-1226 — CVSS 8.8 (high): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka…
• CVE-2026-69632 — CVSS 8.8 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code over a network.
• CVE-2020-1496 — CVSS 8.8 (high): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An…
• CVE-2026-80081 — CVSS 8.8 (high): Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
• CVE-2024-30103 — CVSS 8.8 (high): Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2026-78521 — CVSS 8.8 (high): Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2026-81385 — CVSS 8.8 (high): Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network.
• CVE-2026-70125 — CVSS 8.8 (high): Microsoft Office Outlook Remote Code Execution Vulnerability
• CVE-2026-80080 — CVSS 8.8 (high): Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2020-1446 — CVSS 8.8 (high): A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft…
• CVE-2026-69797 — CVSS 8.8 (high): Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
• CVE-2026-69556 — CVSS 8.8 (high): Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2026-35436 — CVSS 8.8 (high): Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
• CVE-2020-1447 — CVSS 8.8 (high): A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft…
• CVE-2020-1240 — CVSS 8.8 (high): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka…
• CVE-2026-69778 — CVSS 8.8 (high): Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
• CVE-2026-78518 — CVSS 8.8 (high): Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-78517 — CVSS 8.8 (high): Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2024-38021 — CVSS 8.8 (high): Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2026-69529 — CVSS 8.8 (high): Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
• CVE-2026-33114 — CVSS 8.4 (high): Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-26113 — CVSS 8.4 (high): Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-78510 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-26110 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-26109 — CVSS 8.4 (high): Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-20953 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-20952 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-20944 — CVSS 8.4 (high): Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-62557 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-62554 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-59236 — CVSS 8.4 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-54910 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-53784 — CVSS 8.4 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-55045 — CVSS 8.4 (high): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45474 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-53740 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-53733 — CVSS 8.4 (high): Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-53731 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-70130 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-49697 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-21354 — CVSS 8.4 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2025-49696 — CVSS 8.4 (high): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-21362 — CVSS 8.4 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2026-45472 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45463 — CVSS 8.4 (high): Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45461 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45458 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-49695 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45456 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-40367 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code…
• CVE-2026-40366 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code…
• CVE-2025-47957 — CVSS 8.4 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-47953 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-40364 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code…
• CVE-2026-40363 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-30377 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-40361 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2023-36569 — CVSS 8.4 (high): Microsoft Office Elevation of Privilege Vulnerability
• CVE-2026-33115 — CVSS 8.4 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-32190 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-30386 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-32704 — CVSS 8.4 (high): Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-40358 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-32717 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-47162 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-47164 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-47167 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-44822 — CVSS 8.2 (high): Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
• CVE-2021-34469 — CVSS 8.2 (high): Microsoft Office Security Feature Bypass Vulnerability
• CVE-2023-36897 — CVSS 8.1 (high): Visual Studio Tools for Office Runtime Spoofing Vulnerability
• CVE-2023-28295 — CVSS 7.8 (high): Microsoft Publisher Remote Code Execution Vulnerability
• CVE-2023-28311 — CVSS 7.8 (high): Microsoft Word Remote Code Execution Vulnerability
• CVE-2023-29344 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2023-32029 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2023-33133 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2023-33146 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2023-33148 — CVSS 7.8 (high): Microsoft Office Elevation of Privilege Vulnerability
• CVE-2023-33149 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2023-33158 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2023-33161 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2023-35371 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2023-35372 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2023-36037 — CVSS 7.8 (high): Microsoft Excel Security Feature Bypass Vulnerability
• CVE-2023-36041 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2023-36045 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2023-36766 — CVSS 7.8 (high): Microsoft Excel Information Disclosure Vulnerability
• CVE-2023-36865 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2023-36866 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2023-36895 — CVSS 7.8 (high): Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2023-36896 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2024-20677 — CVSS 7.8 (high): A security vulnerability exists in FBX that could lead to remote code execution. To mitigate this vulnerability, the ability to insert FBX…
• CVE-2024-21379 — CVSS 7.8 (high): Microsoft Word Remote Code Execution Vulnerability
• CVE-2024-21384 — CVSS 7.8 (high): Microsoft Office OneNote Remote Code Execution Vulnerability
• CVE-2024-26199 — CVSS 7.8 (high): Microsoft Office Elevation of Privilege Vulnerability
• CVE-2024-26257 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2024-30042 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2024-30104 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2024-38016 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2024-38169 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2024-38171 — CVSS 7.8 (high): Microsoft PowerPoint Remote Code Execution Vulnerability
• CVE-2024-38172 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2024-43463 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2024-43465 — CVSS 7.8 (high): Microsoft Excel Elevation of Privilege Vulnerability
• CVE-2024-43504 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2024-43505 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2024-43576 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2024-43616 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2024-49026 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2024-49027 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2024-49028 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2024-49029 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2024-49030 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2024-49031 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2024-49032 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2024-49069 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2024-49142 — CVSS 7.8 (high): Microsoft Access Remote Code Execution Vulnerability
• CVE-2025-21186 — CVSS 7.8 (high): Microsoft Access Remote Code Execution Vulnerability
• CVE-2025-21345 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2025-21356 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2025-21363 — CVSS 7.8 (high): Microsoft Word Remote Code Execution Vulnerability
• CVE-2025-21364 — CVSS 7.8 (high): Microsoft Excel Security Feature Bypass Vulnerability
• CVE-2025-21365 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2025-21366 — CVSS 7.8 (high): Microsoft Access Remote Code Execution Vulnerability
• CVE-2025-21381 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2025-21383 — CVSS 7.8 (high): Microsoft Excel Information Disclosure Vulnerability
• CVE-2025-21386 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2025-21387 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2025-21390 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2025-21392 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2025-21394 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2025-21395 — CVSS 7.8 (high): Microsoft Access Remote Code Execution Vulnerability
• CVE-2025-21397 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2025-24057 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-24075 — CVSS 7.8 (high): Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-24077 — CVSS 7.8 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-24079 — CVSS 7.8 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-24080 — CVSS 7.8 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-24081 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-24082 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-24083 — CVSS 7.8 (high): Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-26629 — CVSS 7.8 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-26630 — CVSS 7.8 (high): Use after free in Microsoft Office Access allows an unauthorized attacker to execute code locally.
• CVE-2025-26642 — CVSS 7.8 (high): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-27745 — CVSS 7.8 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-27746 — CVSS 7.8 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-27747 — CVSS 7.8 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-27748 — CVSS 7.8 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-27749 — CVSS 7.8 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-27750 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-27751 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-27752 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-29791 — CVSS 7.8 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.