CVE-2021-26618: Tmax Tooffice

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

An improper input validation leading to arbitrary file creation was discovered in ToWord of ToOffice. Remote attackers use this vulnerability to execute arbitrary file included malicious code.

Affected products

• Tmax Tooffice: before 3.15.6 (fixed in 3.15.6)

Published 2022-02-18. Last modified 2026-06-17.