Microsoft Office 2019 — known CVE vulnerabilities

Every CVE whose affected-product data names Microsoft Office 2019, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (24)

• CVE-2024-21413 — CVSS 9.8 (critical) — actively exploited: Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2024-38189 — CVSS 8.8 (high) — actively exploited: Microsoft Project Remote Code Execution Vulnerability
• CVE-2026-45456 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45458 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45461 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45463 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45472 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45474 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-44822 — CVSS 8.2 (high): Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
• CVE-2026-44823 — CVSS 7.8 (high): Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-44824 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45475 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45645 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45469 — CVSS 7.8 (high): Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-45471 — CVSS 7.8 (high): Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-44817 — CVSS 7.8 (high): Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-44819 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-44820 — CVSS 7.8 (high): Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2024-38226 — CVSS 7.3 (high) — actively exploited: Microsoft Publisher Security Feature Bypass Vulnerability
• CVE-2026-44818 — CVSS 7.0 (high): Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-44821 — CVSS 5.5 (medium): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-45460 — CVSS 4.7 (medium): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-45485 — CVSS 3.3 (low): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-45455 — CVSS 3.3 (low): Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.