Microsoft Office Ltsc For Mac 2021 vulnerabilities

24 CVEs affecting Microsoft Office Ltsc For Mac 2021, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-108455, published 2026-10-15.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-70096, published 2026-10-13. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network.
• CVE-2026-81955, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
• CVE-2026-78439, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
• CVE-2026-108453, published 2026-10-15. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
• CVE-2026-108455, published 2026-10-15. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
• CVE-2026-108454, published 2026-10-15. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
• CVE-2026-108438, published 2026-10-15. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
• CVE-2026-108436, published 2026-10-15. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
• CVE-2026-108435, published 2026-10-15. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
• CVE-2026-108434, published 2026-10-15. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

Latest

• CVE-2026-108449, published 2026-10-15. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2026-108448, published 2026-10-15. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
• CVE-2026-108446, published 2026-10-15. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-108445, published 2026-10-15. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2026-108444, published 2026-10-15. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
• CVE-2026-108443, published 2026-10-15. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2026-108442, published 2026-10-15. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.