Microsoft Office 2024 vulnerabilities

434 CVEs affecting Microsoft Office 2024, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-97780, published 2026-10-13.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-81385, published 2026-09-08. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network.
• CVE-2026-70291, published 2026-10-13. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
• CVE-2026-70242, published 2026-10-13. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
• CVE-2026-70281, published 2026-10-13. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.
• CVE-2026-97749, published 2026-10-13. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
• CVE-2026-97016, published 2026-10-13. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
• CVE-2026-88156, published 2026-10-13. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
• CVE-2026-70300, published 2026-10-13. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
• CVE-2026-78509, published 2026-09-08. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
• CVE-2026-70105, published 2026-08-20. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

Latest

• CVE-2026-97780, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97779, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
• CVE-2026-97778, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97777, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97776, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97775, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97773, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97772, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97771, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97770, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.