Microsoft Office 2019 vulnerabilities

293 CVEs affecting Microsoft Office 2019, 6 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-85875, published 2026-09-08.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-21413: Microsoft Outlook Improper Input Validation Vulnerability, published 2024-02-13. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2025-02-06. EPSS: 94.7% chance of exploitation in the next 30 days. Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2021-42292: Microsoft Excel Security Feature Bypass, published 2021-11-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-17. EPSS: 43% chance of exploitation in the next 30 days. Microsoft Excel Security Feature Bypass Vulnerability
• CVE-2023-35311: Microsoft Outlook Security Feature Bypass Vulnerability, published 2023-07-11. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2023-07-11. EPSS: 15.5% chance of exploitation in the next 30 days. Microsoft Outlook Security Feature Bypass Vulnerability
• CVE-2024-38189: Microsoft Project Remote Code Execution Vulnerability, published 2024-08-13. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2024-08-13. EPSS: 8.2% chance of exploitation in the next 30 days. Microsoft Project Remote Code Execution Vulnerability
• CVE-2021-38646: Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability, published 2021-09-15. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-28. EPSS: 8% chance of exploitation in the next 30 days. Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
• CVE-2024-38226: Microsoft Publisher Protection Mechanism Failure Vulnerability, published 2024-09-10. High severity, CVSS 7.3. Actively exploited: in CISA KEV since 2024-09-10. EPSS: 2.7% chance of exploitation in the next 30 days. Microsoft Publisher Security Feature Bypass Vulnerability
• CVE-2026-81385, published 2026-09-08. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network.
• CVE-2026-78509, published 2026-09-08. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
• CVE-2026-72977, published 2026-09-08. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
• CVE-2026-69739, published 2026-09-08. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network.

Latest

• CVE-2026-85875, published 2026-09-08. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
• CVE-2026-83951, published 2026-09-08. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
• CVE-2026-83949, published 2026-09-08. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
• CVE-2026-81960, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-81959, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-81958, published 2026-09-08. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
• CVE-2026-81957, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-81956, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-81954, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
• CVE-2026-81953, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.