Microsoft Office Online Server vulnerabilities
153 known vulnerabilities affecting microsoft/office_online_server.
Total CVEs
153
CISA KEV
1
actively exploited
Public exploits
4
Exploited in wild
3
Severity breakdown
CRITICAL1HIGH133MEDIUM17LOW2
Vulnerabilities
Page 3 of 8
CVE-2026-55137P3HIGHCVSS 7.8fixed in 16.0.10417.20175≥ 16.0.0.0, < 16.0.10417.201752026-07-14
CVE-2026-55137 [HIGH] CWE-122 CVE-2026-55137: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-55041P3HIGHCVSS 7.8fixed in 16.0.10417.20175≥ 16.0.0.0, < 16.0.10417.201752026-07-14
CVE-2026-55041 [HIGH] CWE-122 CVE-2026-55041: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-55948P3HIGHCVSS 7.8fixed in 16.0.10417.20175≥ 16.0.0.0, < 16.0.10417.201752026-07-14
CVE-2026-55948 [HIGH] CWE-416 CVE-2026-55948: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-55029P3HIGHCVSS 7.8fixed in 16.0.10417.20175≥ 16.0.0.0, < 16.0.10417.201752026-07-14
CVE-2026-55029 [HIGH] CWE-122 CVE-2026-55029: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-55053P3HIGHCVSS 7.8fixed in 16.0.10417.20175≥ 16.0.0.0, < 16.0.10417.201752026-07-14
CVE-2026-55053 [HIGH] CWE-122 CVE-2026-55053: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-54131P3HIGHCVSS 7.8fixed in 16.0.10417.20175≥ 16.0.0.0, < 16.0.10417.201752026-07-14
CVE-2026-54131 [HIGH] CWE-416 CVE-2026-54131: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-55037P3HIGHCVSS 7.8fixed in 16.0.10417.20175≥ 16.0.0.0, < 16.0.10417.201752026-07-14
CVE-2026-55037 [HIGH] CWE-122 CVE-2026-55037: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-55947P3HIGHCVSS 7.8fixed in 16.0.10417.20175≥ 16.0.0.0, < 16.0.10417.201752026-07-14
CVE-2026-55947 [HIGH] CWE-122 CVE-2026-55947: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-32198P3HIGHCVSS 7.8fixed in 16.0.10417.20113≥ 16.0.0.0, < 16.0.10417.201132026-04-14
CVE-2026-32198 [HIGH] CWE-416 CVE-2026-32198: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-32199P3HIGHCVSS 7.8fixed in 16.0.10417.20113≥ 16.0.0.0, < 16.0.10417.201132026-04-14
CVE-2026-32199 [HIGH] CWE-416 CVE-2026-32199: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-32197P3HIGHCVSS 7.8fixed in 16.0.10417.20113≥ 16.0.0.0, < 16.0.10417.201132026-04-14
CVE-2026-32197 [HIGH] CWE-416 CVE-2026-32197: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-58618P3HIGHCVSS 7.8fixed in 16.0.10417.20175≥ 16.0.0.0, < 16.0.10417.201752026-07-14
CVE-2026-58618 [HIGH] CWE-122 CVE-2026-58618: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
nvd
CVE-2020-0852P3HIGHCVSS 7.8v1.02020-03-12
CVE-2020-0852 [HIGH] CVE-2020-0852: A remote code execution vulnerability exists in Microsoft Word software when it fails to properly ha
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0850, CVE-2020-0851, CVE-2020-0855, CVE-2020-0892.
nvd
CVE-2020-0892P3HIGHCVSS 7.8v1.02020-03-12
CVE-2020-0892 [HIGH] CVE-2020-0892: A remote code execution vulnerability exists in Microsoft Word software when it fails to properly ha
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0850, CVE-2020-0851, CVE-2020-0852, CVE-2020-0855.
nvd
CVE-2025-54904P3HIGHCVSS 7.8fixed in 16.0.10417.20047≥ 16.0.0.0, < 16.0.10417.200472025-09-09
CVE-2025-54904 [HIGH] CWE-416 CVE-2025-54904: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
nvd
CVE-2025-54896P3HIGHCVSS 7.8fixed in 16.0.10417.20047≥ 16.0.0.0, < 16.0.10417.200472025-09-09
CVE-2025-54896 [HIGH] CWE-416 CVE-2025-54896: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
nvd
CVE-2025-54903P3HIGHCVSS 7.8fixed in 16.0.10417.20047≥ 16.0.0.0, < 16.0.10417.200472025-09-09
CVE-2025-54903 [HIGH] CWE-416 CVE-2025-54903: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
nvd
CVE-2025-54900P3HIGHCVSS 7.8fixed in 16.0.10417.20047≥ 16.0.0.0, < 16.0.10417.200472025-09-09
CVE-2025-54900 [HIGH] CWE-122 CVE-2025-54900: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
nvd
CVE-2025-59225P3HIGHCVSS 7.8fixed in 16.0.10417.20059≥ 16.0.0.0, < 16.0.10417.200592025-10-14
CVE-2025-59225 [HIGH] CWE-416 CVE-2025-59225: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
nvd
CVE-2025-59224P3HIGHCVSS 7.8fixed in 16.0.10417.20059≥ 16.0.0.0, < 16.0.10417.200592025-10-14
CVE-2025-59224 [HIGH] CWE-416 CVE-2025-59224: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
nvd