Microsoft Word vulnerabilities

CVE-2026-41101 [MEDIUM] CWE-284 CVE-2026-41101: Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing l Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.

CVE-2026-42832 [MEDIUM] CWE-284 CVE-2026-42832: Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing loca Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.

CVE-2020-1445 [MEDIUM] CVE-2020-1445: An information disclosure vulnerability exists when Microsoft Office improperly discloses the conten An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka 'Microsoft Office Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1342.

CVE-2022-29107 [MEDIUM] CVE-2022-29107: Microsoft Office Security Feature Bypass Vulnerability Microsoft Office Security Feature Bypass Vulnerability

CVE-2026-55124 [MEDIUM] CWE-20 CVE-2026-55124: Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attac Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

CVE-2026-55142 [MEDIUM] CWE-197 CVE-2026-55142: Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose inform Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

CVE-2026-55050 [MEDIUM] CWE-125 CVE-2026-55050: Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

CVE-2020-1583 [MEDIUM] CVE-2020-1583: An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data. To exploit the vulnerability, an attacker could craft a special document file and then convince the user to open it. An attacker mus

CVE-2020-1503 [MEDIUM] CVE-2020-1503: An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data. To exploit the vulnerability, an attacker could craft a special document file and then convince the user to open it. An attacker mus

CVE-2020-17020 [MEDIUM] CVE-2020-17020: Microsoft Word Security Feature Bypass Vulnerability Microsoft Word Security Feature Bypass Vulnerability

CVE-2024-49065 [MEDIUM] CWE-125 CVE-2024-49065: Microsoft Office Remote Code Execution Vulnerability Microsoft Office Remote Code Execution Vulnerability

CVE-2020-1229 [MEDIUM] CVE-2020-1229: A security feature bypass vulnerability exists in Microsoft Outlook when Office fails to enforce sec A security feature bypass vulnerability exists in Microsoft Outlook when Office fails to enforce security settings configured on a system, aka 'Microsoft Outlook Security Feature Bypass Vulnerability'.

CVE-2026-40421 [MEDIUM] CWE-73 CVE-2026-40421: Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

CVE-2008-6063 [MEDIUM] CWE-200 CVE-2008-6063: Microsoft Word 2007, when the "Save as PDF" add-on is enabled, places an absolute pathname in the Su Microsoft Word 2007, when the "Save as PDF" add-on is enabled, places an absolute pathname in the Subject field during an "Email as PDF" operation, which allows remote attackers to obtain sensitive information such as the sender's account name and a Temporary Internet Files subdirectory name.

CVE-2001-0628 [HIGH] CVE-2001-0628: Microsoft Word 2000 does not check AutoRecovery (.asd) files for macros, which allows a local attack Microsoft Word 2000 does not check AutoRecovery (.asd) files for macros, which allows a local attacker to execute arbitrary macros with the user ID of the Word user.

CVE-2000-0088 [HIGH] CVE-2000-0088: Buffer overflow in the conversion utilities for Japanese, Korean and Chinese Word 5 documents allows Buffer overflow in the conversion utilities for Japanese, Korean and Chinese Word 5 documents allows an attacker to execute commands, aka the "Malformed Conversion Data" vulnerability.

CVE-2000-0765 [MEDIUM] CVE-2000-0765: Buffer overflow in the HTML interpreter in Microsoft Office 2000 allows an attacker to execute arbit Buffer overflow in the HTML interpreter in Microsoft Office 2000 allows an attacker to execute arbitrary commands via a long embedded object tag, aka the "Microsoft Office HTML Object Tag" vulnerability.

CVE-2022-41103 [MEDIUM] CVE-2022-41103: Microsoft Word Information Disclosure Vulnerability Microsoft Word Information Disclosure Vulnerability

CVE-1999-0354 [HIGH] CVE-1999-0354: Internet Explorer 4.x or 5.x with Word 97 allows arbitrary execution of Visual Basic programs to the Internet Explorer 4.x or 5.x with Word 97 allows arbitrary execution of Visual Basic programs to the IE client through the Word 97 template, which doesn't warn the user that the template contains executable content. Also applies to Outlook when the client views a malicious email message.

CVE-2010-3200 [MEDIUM] CVE-2010-3200: MSO.dll in Microsoft Word 2003 SP3 11.8326.11.8324 allows remote attackers to cause a denial of serv MSO.dll in Microsoft Word 2003 SP3 11.8326.11.8324 allows remote attackers to cause a denial of service (NULL pointer dereference and multiple-instance application crash) via a crafted buffer in a Word document, as demonstrated by word_crash_11.8326.8324_poc.doc.