Microsoft Office 2016 vulnerabilities

108 CVEs affecting Microsoft Office 2016, 4 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-85875, published 2026-09-08.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-21413: Microsoft Outlook Improper Input Validation Vulnerability, published 2024-02-13. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2025-02-06. EPSS: 94.7% chance of exploitation in the next 30 days. Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2021-42292: Microsoft Excel Security Feature Bypass, published 2021-11-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-17. EPSS: 43% chance of exploitation in the next 30 days. Microsoft Excel Security Feature Bypass Vulnerability
• CVE-2021-38646: Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability, published 2021-09-15. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-28. EPSS: 8% chance of exploitation in the next 30 days. Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
• CVE-2021-27059: Microsoft Office Remote Code Execution Vulnerability, published 2021-03-11. High severity, CVSS 7.6. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 6.1% chance of exploitation in the next 30 days. Microsoft Office Remote Code Execution Vulnerability
• CVE-2026-69739, published 2026-09-08. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network.
• CVE-2026-80091, published 2026-09-08. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information over a network.
• CVE-2026-80089, published 2026-09-08. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network.
• CVE-2026-80088, published 2026-09-08. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
• CVE-2026-80087, published 2026-09-08. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to disclose information over a network.
• CVE-2026-80084, published 2026-09-08. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.

Latest

• CVE-2026-85875, published 2026-09-08. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
• CVE-2026-81960, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-81959, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-81958, published 2026-09-08. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
• CVE-2026-81957, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-81956, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-81954, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-81953, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-81952, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2026-81951, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.