Microsoft Office 2016 — known CVE vulnerabilities

Every CVE whose affected-product data names Microsoft Office 2016, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (55)

• CVE-2024-21413 — CVSS 9.8 (critical) — actively exploited: Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2026-45461 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45463 — CVSS 8.4 (high): Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45456 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45474 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-55045 — CVSS 8.4 (high): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45472 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45475 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2021-38646 — CVSS 7.8 (high) — actively exploited: Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
• CVE-2021-42292 — CVSS 7.8 (high) — actively exploited: Microsoft Excel Security Feature Bypass Vulnerability
• CVE-2026-44819 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-44824 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-47290 — CVSS 7.8 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-50301 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-50314 — CVSS 7.8 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-50467 — CVSS 7.8 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-50665 — CVSS 7.8 (high): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-55017 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-55018 — CVSS 7.8 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-55022 — CVSS 7.8 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-55049 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-55056 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-55125 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-55129 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-55140 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-63513 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-63515 — CVSS 7.8 (high): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-63526 — CVSS 7.8 (high): Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-63532 — CVSS 7.8 (high): Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-63533 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-64903 — CVSS 7.8 (high): Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-64909 — CVSS 7.8 (high): Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-65661 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45645 — CVSS 7.8 (high): Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2021-27059 — CVSS 7.6 (high) — actively exploited: Microsoft Office Remote Code Execution Vulnerability
• CVE-2026-56193 — CVSS 7.1 (high): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-55026 — CVSS 6.2 (medium): Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-64899 — CVSS 5.5 (medium): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-55139 — CVSS 5.5 (medium): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-63529 — CVSS 5.5 (medium): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-56192 — CVSS 5.5 (medium): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-56195 — CVSS 5.5 (medium): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-70317 — CVSS 5.5 (medium): Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-55023 — CVSS 5.5 (medium): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-55027 — CVSS 5.5 (medium): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-55028 — CVSS 5.5 (medium): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-55035 — CVSS 5.5 (medium): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-55042 — CVSS 5.5 (medium): Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-44821 — CVSS 5.5 (medium): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-68797 — CVSS 5.5 (medium): Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
• CVE-2026-63517 — CVSS 5.5 (medium): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-55057 — CVSS 5.5 (medium): Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-55121 — CVSS 5.5 (medium): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-63524 — CVSS 5.5 (medium): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-45485 — CVSS 3.3 (low): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.