Microsoft Office vulnerabilities

CVE-2026-21261 [MEDIUM] CWE-125 CVE-2026-21261: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVE-2025-59240 [MEDIUM] CWE-200 CVE-2025-59240: Exposure of sensitive information to an unauthorized actor in Microsoft Office Excel allows an unaut Exposure of sensitive information to an unauthorized actor in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVE-2026-35440 [MEDIUM] CWE-552 CVE-2026-35440: Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

CVE-2026-42832 [MEDIUM] CWE-284 CVE-2026-42832: Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing loca Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.

CVE-2020-1445 [MEDIUM] CVE-2020-1445: An information disclosure vulnerability exists when Microsoft Office improperly discloses the conten An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka 'Microsoft Office Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1342.

CVE-2022-29107 [MEDIUM] CVE-2022-29107: Microsoft Office Security Feature Bypass Vulnerability Microsoft Office Security Feature Bypass Vulnerability

CVE-2002-1716 [MEDIUM] CVE-2002-1716: The Host() function in the Microsoft spreadsheet component on Microsoft Office XP allows remote atta The Host() function in the Microsoft spreadsheet component on Microsoft Office XP allows remote attackers to create arbitrary files using the SaveAs capability.

CVE-2025-54901 [MEDIUM] CWE-126 CVE-2025-54901: Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information l Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVE-2006-0008 [HIGH] CWE-264 CVE-2006-0008: The ShellAbout API call in Korean Input Method Editor (IME) in Korean versions of Microsoft Windows The ShellAbout API call in Korean Input Method Editor (IME) in Korean versions of Microsoft Windows XP SP1 and SP2, Windows Server 2003 up to SP1, and Office 2003, allows local users to gain privileges by launching the "shell about dialog box" and clicking the "End-User License Agreement" link, which executes Notepad with the privileges of the program th

CVE-2020-1583 [MEDIUM] CVE-2020-1583: An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data. To exploit the vulnerability, an attacker could craft a special document file and then convince the user to open it. An attacker mus

CVE-2020-1497 [MEDIUM] CVE-2020-1497: An information disclosure vulnerability exists when Microsoft Excel improperly discloses the content An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data. To exploit the vulnerability, an attacker could craft a special document file and then convince the user to open it. An attacker mu

CVE-2020-1502 [MEDIUM] CVE-2020-1502: An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data. To exploit the vulnerability, an attacker could craft a special document file and then convince the user to open it. An attacker mus

CVE-2020-1503 [MEDIUM] CVE-2020-1503: An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data. To exploit the vulnerability, an attacker could craft a special document file and then convince the user to open it. An attacker mus

CVE-2020-1224 [MEDIUM] CVE-2020-1224: <p>An information disclosure vulnerability exists when Microsoft Excel improperly discloses the cont An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data. To exploit the vulnerability, an attacker could craft a special document file and then convince the user to open it. An attacker mu

CVE-2022-22716 [MEDIUM] CWE-119 CVE-2022-22716: Microsoft Excel Information Disclosure Vulnerability Microsoft Excel Information Disclosure Vulnerability

CVE-2006-1305 [MEDIUM] CWE-399 CVE-2006-1305: Microsoft Outlook 2000, 2002, and 2003 allows user-assisted remote attackers to cause a denial of se Microsoft Outlook 2000, 2002, and 2003 allows user-assisted remote attackers to cause a denial of service (memory exhaustion and interrupted mail recovery) via malformed e-mail header information, possibly related to (1) long subject lines or (2) large numbers of recipients in To or CC headers.

CVE-2021-28456 [MEDIUM] CVE-2021-28456: Microsoft Excel Information Disclosure Vulnerability Microsoft Excel Information Disclosure Vulnerability

CVE-2021-31174 [MEDIUM] CWE-125 CVE-2021-31174: Microsoft Excel Information Disclosure Vulnerability Microsoft Excel Information Disclosure Vulnerability

CVE-2022-24462 [MEDIUM] CVE-2022-24462: Microsoft Word Security Feature Bypass Vulnerability Microsoft Word Security Feature Bypass Vulnerability

CVE-2020-17020 [MEDIUM] CVE-2020-17020: Microsoft Word Security Feature Bypass Vulnerability Microsoft Word Security Feature Bypass Vulnerability