Microsoft Office 2016 — known CVE vulnerabilities

Every CVE whose affected-product data names Microsoft Office 2016, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (12)

• CVE-2024-21413 — CVSS 9.8 (critical) — actively exploited: Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2026-45463 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45456 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45461 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45472 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45474 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-44819 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-44824 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45645 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45475 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-44821 — CVSS 5.5 (medium): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-45485 — CVSS 3.3 (low): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.