Microsoft Office Online Server vulnerabilities

CVE-2026-55124 [MEDIUM] CWE-20 CVE-2026-55124: Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attac Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

CVE-2026-55050 [MEDIUM] CWE-125 CVE-2026-55050: Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

CVE-2026-50408 [MEDIUM] CWE-125 CVE-2026-50408: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVE-2026-54988 [MEDIUM] CWE-125 CVE-2026-54988: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVE-2026-48580 [MEDIUM] CWE-822 CVE-2026-48580: Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVE-2026-55138 [MEDIUM] CWE-822 CVE-2026-55138: Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVE-2025-48812 [MEDIUM] CWE-125 CVE-2025-48812: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVE-2020-0695 [MEDIUM] CWE-346 CVE-2020-0695: A spoofing vulnerability exists when Office Online Server does not validate origin in cross-origin c A spoofing vulnerability exists when Office Online Server does not validate origin in cross-origin communications correctly, aka 'Microsoft Office Online Server Spoofing Vulnerability'.

CVE-2019-1445 [MEDIUM] CWE-346 CVE-2019-1445: A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communic A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'Microsoft Office Online Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1447.

CVE-2026-45455 [MEDIUM] CWE-125 CVE-2026-45455: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVE-2020-0647 [MEDIUM] CWE-346 CVE-2020-0647: A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communic A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications correctly, aka 'Microsoft Office Online Spoofing Vulnerability'.

CVE-2018-0919 [LOW] CWE-125 CVE-2018-0919: Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2 Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps 2013 SP1, Microsoft SharePoint Enterprise Server 2013 SP1, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2010 SP2, Microsoft Word 2010 SP2, Word 2013 SP1

CVE-2026-50678 [LOW] CWE-122 CVE-2026-50678: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to disclose inf Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.