Microsoft Office vulnerabilities

CVE-2025-59235 [HIGH] CWE-125 CVE-2025-59235: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVE-2025-60726 [HIGH] CWE-125 CVE-2025-60726: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVE-2025-62202 [HIGH] CWE-125 CVE-2025-62202: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVE-2016-0141 [MEDIUM] CWE-200 CVE-2016-0141: The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certific The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation, which allows attackers to obtain sensitive information via unspecified vectors, aka "Microsoft Information Disclosure Vulnerability."

CVE-2020-1493 [MEDIUM] CWE-922 CVE-2020-1493: An information disclosure vulnerability exists when attaching files to Outlook messages. This vulner An information disclosure vulnerability exists when attaching files to Outlook messages. This vulnerability could potentially allow users to share attached files such that they are accessible by anonymous users where they should be restricted to specific users. To exploit this vulnerability, an attacker would have to attach a file as a link to an emai

CVE-2014-6362 [MEDIUM] CVE-2014-6362: Use-after-free vulnerability in Microsoft Office 2007 SP3, 2010 SP2, and 2013 Gold and SP1 allows re Use-after-free vulnerability in Microsoft Office 2007 SP3, 2010 SP2, and 2013 Gold and SP1 allows remote attackers to bypass the ASLR protection mechanism via a crafted document, aka "Microsoft Office Component Use After Free Vulnerability."

CVE-2006-2387 [MEDIUM] CVE-2006-2387: Unspecified vulnerability in Microsoft Excel 2000, 2002, 2003, 2004 for Mac, v.X for Mac, Excel View Unspecified vulnerability in Microsoft Excel 2000, 2002, 2003, 2004 for Mac, v.X for Mac, Excel Viewer 2003, and Microsoft Works Suite 2004 through 2006 allows user-assisted attackers to execute arbitrary code via a crafted DATETIME record in an XLS file, a different vulnerability than CVE-2006-3867 and CVE-2006-3875.

CVE-2025-59232 [HIGH] CWE-125 CVE-2025-59232: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVE-2026-32188 [HIGH] CWE-125 CVE-2026-32188: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVE-2024-49059 [HIGH] CWE-59 CVE-2024-49059: Microsoft Office Elevation of Privilege Vulnerability Microsoft Office Elevation of Privilege Vulnerability

CVE-2021-31178 [MEDIUM] CWE-191 CVE-2021-31178: Microsoft Office Information Disclosure Vulnerability Microsoft Office Information Disclosure Vulnerability

CVE-2018-1007 [MEDIUM] CVE-2018-1007: An information disclosure vulnerability exists when Microsoft Office improperly discloses the conten An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka "Microsoft Office Information Disclosure Vulnerability." This affects Microsoft Office. This CVE ID is unique from CVE-2018-0950.

CVE-2025-54905 [HIGH] CWE-822 CVE-2025-54905: Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose i Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

CVE-2023-36568 [HIGH] CWE-59 CVE-2023-36568: Microsoft Office Click-To-Run Elevation of Privilege Vulnerability Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

CVE-2023-36565 [HIGH] CWE-416 CVE-2023-36565: Microsoft Office Graphics Elevation of Privilege Vulnerability Microsoft Office Graphics Elevation of Privilege Vulnerability

CVE-2025-53736 [MEDIUM] CWE-126 CVE-2025-53736: Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information lo Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

CVE-2018-8378 [MEDIUM] CWE-125 CVE-2018-8378: An information disclosure vulnerability exists when Microsoft Office software reads out of bound mem An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memory, aka "Microsoft Office Information Disclosure Vulnerability." This affects Word, Microsoft SharePoint Server, Microsoft Office Word Viewer, Microsoft Excel Viewer, Microso

CVE-2019-1461 [MEDIUM] CVE-2019-1461: A denial of service vulnerability exists in Microsoft Word software when the software fails to prope A denial of service vulnerability exists in Microsoft Word software when the software fails to properly handle objects in memory, aka 'Microsoft Word Denial of Service Vulnerability'.

CVE-2018-8163 [MEDIUM] CWE-200 CVE-2018-8163: An information disclosure vulnerability exists when Microsoft Excel improperly discloses the content An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosure Vulnerability." This affects Microsoft Office, Microsoft Excel.

CVE-2017-11934 [MEDIUM] CWE-200 CVE-2017-11934: Microsoft Office 2013 RT SP1, Microsoft Office 2013 SP1, and Microsoft Office 2016 allow an informat Microsoft Office 2013 RT SP1, Microsoft Office 2013 SP1, and Microsoft Office 2016 allow an information disclosure vulnerability due to the way certain functions handle objects in memory, aka "Microsoft Office Information Disclosure Vulnerability".