Microsoft Office 2021 — known CVE vulnerabilities

Every CVE whose affected-product data names Microsoft Office 2021, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (27)

• CVE-2026-45472 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45474 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45456 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45458 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45461 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45463 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-44822 — CVSS 8.2 (high): Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
• CVE-2026-44824 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45645 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-45471 — CVSS 7.8 (high): Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-45457 — CVSS 7.8 (high): Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-45475 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-44823 — CVSS 7.8 (high): Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-45486 — CVSS 7.8 (high): Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-45469 — CVSS 7.8 (high): Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-44819 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-44820 — CVSS 7.8 (high): Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-44817 — CVSS 7.8 (high): Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-45643 — CVSS 7.8 (high): Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-47293 — CVSS 7.0 (high): Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
• CVE-2026-44818 — CVSS 7.0 (high): Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-44821 — CVSS 5.5 (medium): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-45460 — CVSS 4.7 (medium): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-45466 — CVSS 3.3 (low): Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
• CVE-2026-45485 — CVSS 3.3 (low): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-45459 — CVSS 3.3 (low): Protection mechanism failure in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally.
• CVE-2026-45455 — CVSS 3.3 (low): Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.