Microsoft Office Long Term Servicing Channel — known CVE vulnerabilities

Every CVE whose affected-product data names Microsoft Office Long Term Servicing Channel, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (200)

• CVE-2024-21413 — CVSS 9.8 (critical) — actively exploited: Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2023-21716 — CVSS 9.8 (critical): Microsoft Word Remote Code Execution Vulnerability
• CVE-2025-60724 — CVSS 9.8 (critical): Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
• CVE-2023-23397 — CVSS 9.8 (critical) — actively exploited: Microsoft Outlook Elevation of Privilege Vulnerability
• CVE-2023-33150 — CVSS 9.6 (critical): Microsoft Office Security Feature Bypass Vulnerability
• CVE-2022-21840 — CVSS 8.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2024-30103 — CVSS 8.8 (high): Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2022-34717 — CVSS 8.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2026-40420 — CVSS 8.8 (high): Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
• CVE-2026-35436 — CVSS 8.8 (high): Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
• CVE-2024-21378 — CVSS 8.8 (high): Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2022-41106 — CVSS 8.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2023-35311 — CVSS 8.8 (high) — actively exploited: Microsoft Outlook Security Feature Bypass Vulnerability
• CVE-2024-38189 — CVSS 8.8 (high) — actively exploited: Microsoft Project Remote Code Execution Vulnerability
• CVE-2023-33131 — CVSS 8.8 (high): Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2024-38021 — CVSS 8.8 (high): Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2026-32190 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-47953 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-26113 — CVSS 8.4 (high): Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-40363 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-47167 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-47164 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-47162 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-40367 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code…
• CVE-2026-26110 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-54910 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-53733 — CVSS 8.4 (high): Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-30386 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-30377 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2023-36569 — CVSS 8.4 (high): Microsoft Office Elevation of Privilege Vulnerability
• CVE-2025-21362 — CVSS 8.4 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2025-21354 — CVSS 8.4 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2025-53784 — CVSS 8.4 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-26109 — CVSS 8.4 (high): Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-20953 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-40358 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-53740 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-32704 — CVSS 8.4 (high): Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-20952 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-40361 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-33115 — CVSS 8.4 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-40366 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code…
• CVE-2026-20944 — CVSS 8.4 (high): Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-62557 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-53731 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-49697 — CVSS 8.4 (high): Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-33114 — CVSS 8.4 (high): Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-62554 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-59236 — CVSS 8.4 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-49696 — CVSS 8.4 (high): Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-49695 — CVSS 8.4 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-47957 — CVSS 8.4 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-40364 — CVSS 8.4 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code…
• CVE-2023-36897 — CVSS 8.1 (high): Visual Studio Tools for Office Runtime Spoofing Vulnerability
• CVE-2023-35371 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2023-35372 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2023-36037 — CVSS 7.8 (high): Microsoft Excel Security Feature Bypass Vulnerability
• CVE-2023-36041 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2023-36045 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2023-36766 — CVSS 7.8 (high): Microsoft Excel Information Disclosure Vulnerability
• CVE-2023-36865 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2023-36866 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2023-36895 — CVSS 7.8 (high): Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2023-36896 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2024-20673 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2024-20677 — CVSS 7.8 (high): A security vulnerability exists in FBX that could lead to remote code execution. To mitigate this vulnerability, the ability to insert FBX…
• CVE-2024-21379 — CVSS 7.8 (high): Microsoft Word Remote Code Execution Vulnerability
• CVE-2024-21384 — CVSS 7.8 (high): Microsoft Office OneNote Remote Code Execution Vulnerability
• CVE-2021-40442 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-40471 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-40473 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-40474 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-40479 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-40480 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2021-40485 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-42296 — CVSS 7.8 (high): Microsoft Word Remote Code Execution Vulnerability
• CVE-2021-43256 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-43875 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2022-21841 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2022-21988 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2022-22003 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2022-24461 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2022-24473 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2022-24509 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2022-24510 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2022-26901 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2022-29109 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2022-30174 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2022-37962 — CVSS 7.8 (high): Microsoft PowerPoint Remote Code Execution Vulnerability
• CVE-2022-37963 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2022-38010 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2022-38048 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2022-38049 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2022-41031 — CVSS 7.8 (high): Microsoft Word Remote Code Execution Vulnerability
• CVE-2022-41061 — CVSS 7.8 (high): Microsoft Word Remote Code Execution Vulnerability
• CVE-2022-41063 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2022-41107 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2022-44691 — CVSS 7.8 (high): Microsoft Office OneNote Remote Code Execution Vulnerability
• CVE-2022-44692 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2022-44694 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2022-44695 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2022-44696 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2023-21734 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2023-21735 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2023-21736 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2023-21737 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2023-21738 — CVSS 7.8 (high): Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2023-23399 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2023-24910 — CVSS 7.8 (high): Windows Graphics Component Elevation of Privilege Vulnerability
• CVE-2023-24953 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2023-28285 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2023-28287 — CVSS 7.8 (high): Microsoft Publisher Remote Code Execution Vulnerability
• CVE-2023-28295 — CVSS 7.8 (high): Microsoft Publisher Remote Code Execution Vulnerability
• CVE-2023-28311 — CVSS 7.8 (high): Microsoft Word Remote Code Execution Vulnerability
• CVE-2023-29344 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2023-32029 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2023-33133 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2023-33146 — CVSS 7.8 (high): Microsoft Office Remote Code Execution Vulnerability
• CVE-2023-33148 — CVSS 7.8 (high): Microsoft Office Elevation of Privilege Vulnerability
• CVE-2023-33149 — CVSS 7.8 (high): Microsoft Office Graphics Remote Code Execution Vulnerability
• CVE-2023-33158 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2023-33161 — CVSS 7.8 (high): Microsoft Excel Remote Code Execution Vulnerability
• CVE-2025-47175 — CVSS 7.8 (high): Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
• CVE-2025-47176 — CVSS 7.8 (high): '.../...//' in Microsoft Office Outlook allows an authorized attacker to execute code locally.
• CVE-2025-47994 — CVSS 7.8 (high): Deserialization of untrusted data in Microsoft Office allows an unauthorized attacker to elevate privileges locally.
• CVE-2025-49698 — CVSS 7.8 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-49700 — CVSS 7.8 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-49702 — CVSS 7.8 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-49703 — CVSS 7.8 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-49705 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
• CVE-2025-49711 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-53730 — CVSS 7.8 (high): Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally.
• CVE-2025-53734 — CVSS 7.8 (high): Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally.
• CVE-2025-53735 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-53737 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-53738 — CVSS 7.8 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-53739 — CVSS 7.8 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code…
• CVE-2025-53741 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-53759 — CVSS 7.8 (high): Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-53761 — CVSS 7.8 (high): Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
• CVE-2025-54896 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-54898 — CVSS 7.8 (high): Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-54899 — CVSS 7.8 (high): Free of memory not on the heap in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-54900 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-54902 — CVSS 7.8 (high): Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-54903 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-54904 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-54906 — CVSS 7.8 (high): Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-54907 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code locally.
• CVE-2025-54908 — CVSS 7.8 (high): Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
• CVE-2025-59222 — CVSS 7.8 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-59223 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-59224 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-59225 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-59226 — CVSS 7.8 (high): Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally.
• CVE-2025-59227 — CVSS 7.8 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-59231 — CVSS 7.8 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code…
• CVE-2025-59233 — CVSS 7.8 (high): Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code…
• CVE-2025-59234 — CVSS 7.8 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-59238 — CVSS 7.8 (high): Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
• CVE-2025-59243 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-60727 — CVSS 7.8 (high): Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-62199 — CVSS 7.8 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-62200 — CVSS 7.8 (high): Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-62201 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-62203 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-62205 — CVSS 7.8 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-62216 — CVSS 7.8 (high): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2025-62552 — CVSS 7.8 (high): Relative path traversal in Microsoft Office Access allows an unauthorized attacker to execute code locally.
• CVE-2025-62553 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-62556 — CVSS 7.8 (high): Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-62558 — CVSS 7.8 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-62559 — CVSS 7.8 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2025-62560 — CVSS 7.8 (high): Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-62561 — CVSS 7.8 (high): Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-62562 — CVSS 7.8 (high): Use after free in Microsoft Office Outlook allows an unauthorized attacker to execute code locally.
• CVE-2025-62563 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2025-62564 — CVSS 7.8 (high): Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-20946 — CVSS 7.8 (high): Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-20948 — CVSS 7.8 (high): Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-20949 — CVSS 7.8 (high): Improper access control in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally.
• CVE-2026-20950 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-20955 — CVSS 7.8 (high): Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-20956 — CVSS 7.8 (high): Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-20957 — CVSS 7.8 (high): Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-21259 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to elevate privileges locally.
• CVE-2026-21509 — CVSS 7.8 (high) — actively exploited: Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature…
• CVE-2026-21514 — CVSS 7.8 (high) — actively exploited: Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature…
• CVE-2026-23657 — CVSS 7.8 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-26107 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-26108 — CVSS 7.8 (high): Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-26112 — CVSS 7.8 (high): Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-32189 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-32197 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-32198 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-32199 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-32200 — CVSS 7.8 (high): Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
• CVE-2026-33095 — CVSS 7.8 (high): Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-40359 — CVSS 7.8 (high): Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-40360 — CVSS 7.8 (high): Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.