Microsoft Excel Viewer vulnerabilities

125 CVEs affecting Microsoft Excel Viewer, 7 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-0669, published 2019-03-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-3906: Microsoft Graphics Component Memory Corruption Vulnerability, published 2013-11-06. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-02-15. EPSS: 84.9% chance of exploitation in the next 30 days. GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows…
CVE-2009-3129: Microsoft Excel Featheader Record Memory Corruption Vulnerability, published 2009-11-11. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 84% chance of exploitation in the next 30 days. Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2;…
CVE-2016-7262: Microsoft Office Security Feature Bypass Vulnerability, published 2016-12-20. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 57.7% chance of exploitation in the next 30 days. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow user-assisted remote attackers to execute arbitrary…
CVE-2019-0541: Microsoft MSHTML Remote Code Execution Vulnerability, published 2019-01-08. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 53.2% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office,…
CVE-2007-0671: Microsoft Office Excel Remote Code Execution Vulnerability, published 2007-02-03. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-08-12. EPSS: 43.2% chance of exploitation in the next 30 days. Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack…
CVE-2009-0238: Microsoft Office Remote Code Execution, published 2009-02-25. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2026-04-14. EPSS: 42.9% chance of exploitation in the next 30 days. Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in…
CVE-2015-2424: Microsoft PowerPoint Memory Corruption Vulnerability, published 2015-07-14. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 40.4% chance of exploitation in the next 30 days. Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, and PowerPoint 2013 RT SP1 allow remote attackers to execute arbitrary code or…
CVE-2008-0081, published 2008-01-16. Critical severity, CVSS 9.8. EPSS: 57.9% chance of exploitation in the next 30 days. Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via crafted macros, aka…
CVE-2008-3471, published 2008-10-15. High severity, CVSS 9.3. EPSS: 52.3% chance of exploitation in the next 30 days. Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Office Excel Viewer; Office Compatibility Pack for Word,…
CVE-2008-0111, published 2008-03-11. High severity, CVSS 9.3. EPSS: 50.9% chance of exploitation in the next 30 days. Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2007, Viewer 2003, Compatibility Pack, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via…

Latest

CVE-2019-0669, published 2019-03-05. Medium severity, CVSS 6.5. EPSS: 6.4% chance of exploitation in the next 30 days. An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability'.
CVE-2019-0540, published 2019-03-05. Medium severity, CVSS 5.5. EPSS: 12.8% chance of exploitation in the next 30 days. A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafted file, which could trick the victim into entering…
CVE-2018-8627, published 2018-12-12. Medium severity, CVSS 5.5. EPSS: 8.6% chance of exploitation in the next 30 days. An information disclosure vulnerability exists when Microsoft Excel software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memory, aka "Microsoft…
CVE-2018-8577, published 2018-11-14. High severity, CVSS 7.8. EPSS: 19.1% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Remote Code Execution Vulnerability." This…
CVE-2018-8432, published 2018-10-10. High severity, CVSS 7.8. EPSS: 19.5% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics Components Remote Code Execution Vulnerability." This…
CVE-2018-8427, published 2018-10-10. Medium severity, CVSS 5.5. EPSS: 2.3% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics Components Information Disclosure Vulnerability." This…
CVE-2018-8429, published 2018-09-13. Medium severity, CVSS 5.5. EPSS: 12.3% chance of exploitation in the next 30 days. An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosure Vulnerability." This affects Microsoft…
CVE-2018-8382, published 2018-08-15. Medium severity, CVSS 5.5. EPSS: 12.3% chance of exploitation in the next 30 days. An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosure Vulnerability." This affects Microsoft…
CVE-2018-8378, published 2018-08-15. Medium severity, CVSS 5.5. EPSS: 6.8% chance of exploitation in the next 30 days. An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memory, aka "Microsoft…