Microsoft Sharepoint Server 2019 vulnerabilities

CVE-2025-49703 [HIGH] CWE-416 CVE-2025-49703: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2021-40486 [HIGH] CVE-2021-40486: Microsoft Word Remote Code Execution Vulnerability Microsoft Word Remote Code Execution Vulnerability

CVE-2024-21426 [HIGH] CWE-416 CVE-2024-21426: Microsoft SharePoint Server Remote Code Execution Vulnerability Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2023-33159 [HIGH] CWE-79 CVE-2023-33159: Microsoft SharePoint Server Spoofing Vulnerability Microsoft SharePoint Server Spoofing Vulnerability

CVE-2025-27747 [HIGH] CWE-822 CVE-2025-27747: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2021-42294 [HIGH] CVE-2021-42294: Microsoft SharePoint Server Remote Code Execution Vulnerability Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2025-54906 [HIGH] CWE-416 CVE-2025-54906: Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code l Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2025-47169 [HIGH] CWE-122 CVE-2025-47169: Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2025-47168 [HIGH] CWE-416 CVE-2025-47168: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2019-1035 [HIGH] CVE-2019-1035: A remote code execution vulnerability exists in Microsoft Word software when it fails to properly ha A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with

CVE-2025-59222 [HIGH] CWE-416 CVE-2025-59222: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2021-28453 [HIGH] CVE-2021-28453: Microsoft Word Remote Code Execution Vulnerability Microsoft Word Remote Code Execution Vulnerability

CVE-2020-17089 [HIGH] CVE-2020-17089: Microsoft SharePoint Elevation of Privilege Vulnerability Microsoft SharePoint Elevation of Privilege Vulnerability

CVE-2023-36892 [HIGH] CWE-79 CVE-2023-36892: Microsoft SharePoint Server Spoofing Vulnerability Microsoft SharePoint Server Spoofing Vulnerability

CVE-2023-36891 [HIGH] CWE-79 CVE-2023-36891: Microsoft SharePoint Server Spoofing Vulnerability Microsoft SharePoint Server Spoofing Vulnerability

CVE-2021-31948 [HIGH] CVE-2021-31948: Microsoft SharePoint Server Spoofing Vulnerability Microsoft SharePoint Server Spoofing Vulnerability

CVE-2025-29976 [HIGH] CWE-269 CVE-2025-29976: Improper privilege management in Microsoft Office SharePoint allows an authorized attacker to elevat Improper privilege management in Microsoft Office SharePoint allows an authorized attacker to elevate privileges locally.

CVE-2026-20948 [HIGH] CWE-822 CVE-2026-20948: Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute co Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2026-45471 [HIGH] CWE-822 CVE-2026-45471: Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute co Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2023-33165 [HIGH] CWE-200 CVE-2023-33165: Microsoft SharePoint Server Security Feature Bypass Vulnerability Microsoft SharePoint Server Security Feature Bypass Vulnerability