Microsoft Office vulnerabilities

1,025 CVEs affecting Microsoft Office, 34 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-70105, published 2026-08-20.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2012-0158: Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability, published 2012-04-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 100% chance of exploitation in the next 30 days. The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office…
• CVE-2017-11882: Microsoft Office Memory Corruption Vulnerability, published 2017-11-15. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 99.9% chance of exploitation in the next 30 days. Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of…
• CVE-2017-0199: Microsoft Office and WordPad Remote Code Execution Vulnerability, published 2017-04-12. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 99.5% chance of exploitation in the next 30 days. Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote…
• CVE-2015-1641: Microsoft Office Memory Corruption Vulnerability, published 2015-04-14. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 97.2% chance of exploitation in the next 30 days. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and…
• CVE-2023-23397: Microsoft Office Outlook Privilege Escalation Vulnerability, published 2023-03-14. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-03-14. EPSS: 97.2% chance of exploitation in the next 30 days. Microsoft Outlook Elevation of Privilege Vulnerability
• CVE-2018-0798: Microsoft Office Memory Corruption Vulnerability, published 2018-01-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 95.1% chance of exploitation in the next 30 days. Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in…
• CVE-2018-0802: Microsoft Office Memory Corruption Vulnerability, published 2018-01-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 93.3% chance of exploitation in the next 30 days. Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in…
• CVE-2017-8570: Microsoft Office Remote Code Execution Vulnerability, published 2017-07-11. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-02-25. EPSS: 89.9% chance of exploitation in the next 30 days. Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CVE ID is unique from…
• CVE-2010-3333: Microsoft Office Stack-based Buffer Overflow Vulnerability, published 2010-11-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 89.4% chance of exploitation in the next 30 days. Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac…
• CVE-2015-2545: Microsoft Office Malformed EPS File Vulnerability, published 2015-09-09. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 85.9% chance of exploitation in the next 30 days. Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted EPS image, aka "Microsoft Office Malformed EPS File Vulnerability."

Latest

• CVE-2026-70105, published 2026-08-20. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
• CVE-2026-55054, published 2026-07-14. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
• CVE-2026-47293, published 2026-06-09. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
• CVE-2026-42832, published 2026-05-12. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.
• CVE-2026-42831, published 2026-05-12. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-40421, published 2026-05-12. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
• CVE-2026-40420, published 2026-05-12. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
• CVE-2026-40419, published 2026-05-12. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
• CVE-2026-40418, published 2026-05-12. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
• CVE-2026-40367, published 2026-05-12. High severity, CVSS 8.4. EPSS: 0.4% chance of exploitation in the next 30 days. Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.