Microsoft Office Compatibility Pack vulnerabilities

206 CVEs affecting Microsoft Office Compatibility Pack, 13 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-0669, published 2019-03-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-1641: Microsoft Office Memory Corruption Vulnerability, published 2015-04-14. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 97.2% chance of exploitation in the next 30 days. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and…
CVE-2018-0798: Microsoft Office Memory Corruption Vulnerability, published 2018-01-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 95.1% chance of exploitation in the next 30 days. Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in…
CVE-2018-0802: Microsoft Office Memory Corruption Vulnerability, published 2018-01-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 93.3% chance of exploitation in the next 30 days. Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in…
CVE-2013-3906: Microsoft Graphics Component Memory Corruption Vulnerability, published 2013-11-06. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-02-15. EPSS: 84.9% chance of exploitation in the next 30 days. GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows…
CVE-2017-11826: Microsoft Office Remote Code Execution Vulnerability, published 2017-10-13. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 81.3% chance of exploitation in the next 30 days. Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation…
CVE-2014-1761: Microsoft Word Memory Corruption Vulnerability, published 2014-03-25. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-02-15. EPSS: 77.7% chance of exploitation in the next 30 days. Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2…
CVE-2009-0563: Microsoft Office Buffer Overflow Vulnerability, published 2009-06-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-06-08. EPSS: 62.8% chance of exploitation in the next 30 days. Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word…
CVE-2016-7262: Microsoft Office Security Feature Bypass Vulnerability, published 2016-12-20. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 57.7% chance of exploitation in the next 30 days. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow user-assisted remote attackers to execute arbitrary…
CVE-2016-7193: Microsoft Office Memory Corruption Vulnerability, published 2016-10-14. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 57.6% chance of exploitation in the next 30 days. Microsoft Word 2007 SP2, Office 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on…
CVE-2012-2539: Microsoft Word Remote Code Execution Vulnerability, published 2012-12-12. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-28. EPSS: 53% chance of exploitation in the next 30 days. Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a…

Latest

CVE-2019-0669, published 2019-03-05. Medium severity, CVSS 6.5. EPSS: 6.4% chance of exploitation in the next 30 days. An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability'.
CVE-2018-8628, published 2018-12-12. High severity, CVSS 7.8. EPSS: 15.9% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka "Microsoft PowerPoint Remote Code Execution…
CVE-2018-8627, published 2018-12-12. Medium severity, CVSS 5.5. EPSS: 8.6% chance of exploitation in the next 30 days. An information disclosure vulnerability exists when Microsoft Excel software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memory, aka "Microsoft…
CVE-2018-8597, published 2018-12-12. High severity, CVSS 7.8. EPSS: 16.1% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Remote Code Execution Vulnerability." This…
CVE-2018-8577, published 2018-11-14. High severity, CVSS 7.8. EPSS: 19.1% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Remote Code Execution Vulnerability." This…
CVE-2018-8432, published 2018-10-10. High severity, CVSS 7.8. EPSS: 19.5% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics Components Remote Code Execution Vulnerability." This…
CVE-2018-8427, published 2018-10-10. Medium severity, CVSS 5.5. EPSS: 2.3% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics Components Information Disclosure Vulnerability." This…
CVE-2018-8429, published 2018-09-13. Medium severity, CVSS 5.5. EPSS: 12.3% chance of exploitation in the next 30 days. An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosure Vulnerability." This affects Microsoft…
CVE-2018-8382, published 2018-08-15. Medium severity, CVSS 5.5. EPSS: 12.3% chance of exploitation in the next 30 days. An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosure Vulnerability." This affects Microsoft…
CVE-2018-8378, published 2018-08-15. Medium severity, CVSS 5.5. EPSS: 6.8% chance of exploitation in the next 30 days. An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memory, aka "Microsoft…