Microsoft Office Long Term Servicing Channel vulnerabilities

366 CVEs affecting Microsoft Office Long Term Servicing Channel, 7 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-42832, published 2026-05-12.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-23397: Microsoft Office Outlook Privilege Escalation Vulnerability, published 2023-03-14. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-03-14. EPSS: 97.2% chance of exploitation in the next 30 days. Microsoft Outlook Elevation of Privilege Vulnerability
• CVE-2024-21413: Microsoft Outlook Improper Input Validation Vulnerability, published 2024-02-13. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2025-02-06. EPSS: 94.7% chance of exploitation in the next 30 days. Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2026-21509: Microsoft Office Security Feature Bypass Vulnerability, published 2026-01-26. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-01-26. EPSS: 70.8% chance of exploitation in the next 30 days. Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.
• CVE-2023-36761: Microsoft Word Information Disclosure Vulnerability, published 2023-09-12. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2023-09-12. EPSS: 19.6% chance of exploitation in the next 30 days. Microsoft Word Information Disclosure Vulnerability
• CVE-2024-38189: Microsoft Project Remote Code Execution Vulnerability, published 2024-08-13. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2024-08-13. EPSS: 8.2% chance of exploitation in the next 30 days. Microsoft Project Remote Code Execution Vulnerability
• CVE-2024-38226: Microsoft Publisher Protection Mechanism Failure Vulnerability, published 2024-09-10. High severity, CVSS 7.3. Actively exploited: in CISA KEV since 2024-09-10. EPSS: 2.7% chance of exploitation in the next 30 days. Microsoft Publisher Security Feature Bypass Vulnerability
• CVE-2026-21514: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability, published 2026-02-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-02-10. EPSS: 1.6% chance of exploitation in the next 30 days. Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
• CVE-2023-21716, published 2023-02-14. Critical severity, CVSS 9.8. EPSS: 84.8% chance of exploitation in the next 30 days. Microsoft Word Remote Code Execution Vulnerability
• CVE-2023-36041, published 2023-11-14. High severity, CVSS 7.8. EPSS: 56.7% chance of exploitation in the next 30 days. Microsoft Excel Remote Code Execution Vulnerability
• CVE-2023-32029, published 2023-06-14. High severity, CVSS 7.8. EPSS: 53.5% chance of exploitation in the next 30 days. Microsoft Excel Remote Code Execution Vulnerability

Latest

• CVE-2026-42832, published 2026-05-12. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.
• CVE-2026-42831, published 2026-05-12. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
• CVE-2026-40421, published 2026-05-12. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
• CVE-2026-40420, published 2026-05-12. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
• CVE-2026-40419, published 2026-05-12. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
• CVE-2026-40418, published 2026-05-12. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
• CVE-2026-40367, published 2026-05-12. High severity, CVSS 8.4. EPSS: 0.4% chance of exploitation in the next 30 days. Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-40366, published 2026-05-12. High severity, CVSS 8.4. EPSS: 0.4% chance of exploitation in the next 30 days. Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-40364, published 2026-05-12. High severity, CVSS 8.4. EPSS: 0.4% chance of exploitation in the next 30 days. Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-40363, published 2026-05-12. High severity, CVSS 8.4. EPSS: 0.4% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.