Microsoft Excel vulnerabilities

502 CVEs affecting Microsoft Excel, 6 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-85875, published 2026-09-08.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2009-3129: Microsoft Excel Featheader Record Memory Corruption Vulnerability, published 2009-11-11. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 84% chance of exploitation in the next 30 days. Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2;…
• CVE-2016-7262: Microsoft Office Security Feature Bypass Vulnerability, published 2016-12-20. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 57.7% chance of exploitation in the next 30 days. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow user-assisted remote attackers to execute arbitrary…
• CVE-2007-0671: Microsoft Office Excel Remote Code Execution Vulnerability, published 2007-02-03. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-08-12. EPSS: 43.2% chance of exploitation in the next 30 days. Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack…
• CVE-2021-42292: Microsoft Excel Security Feature Bypass, published 2021-11-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-17. EPSS: 43% chance of exploitation in the next 30 days. Microsoft Excel Security Feature Bypass Vulnerability
• CVE-2009-0238: Microsoft Office Remote Code Execution, published 2009-02-25. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2026-04-14. EPSS: 42.9% chance of exploitation in the next 30 days. Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in…
• CVE-2019-1297: Microsoft Excel Remote Code Execution Vulnerability, published 2019-09-11. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 21.8% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.
• CVE-2011-0105, published 2011-04-13. High severity, CVSS 9.3. EPSS: 70.2% chance of exploitation in the next 30 days. Microsoft Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac obtain a certain length value from an uninitialized memory location, which allows remote attackers…
• CVE-2010-0822, published 2010-06-08. High severity, CVSS 9.3. EPSS: 70.1% chance of exploitation in the next 30 days. Stack-based buffer overflow in Microsoft Office Excel 2002 SP3, Office 2004 for Mac, Office 2008 for Mac, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code…
• CVE-2010-0258, published 2010-03-10. High severity, CVSS 7.8. EPSS: 61% chance of exploitation in the next 30 days. Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack…
• CVE-2008-0081, published 2008-01-16. Critical severity, CVSS 9.8. EPSS: 57.9% chance of exploitation in the next 30 days. Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via crafted macros, aka…

Latest

• CVE-2026-85875, published 2026-09-08. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
• CVE-2026-81960, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-81959, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-81958, published 2026-09-08. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
• CVE-2026-81957, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-81956, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-81954, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-81953, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-81951, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-81950, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.