Microsoft Project vulnerabilities

30 CVEs affecting Microsoft Project, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-1322, published 2020-06-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2007-0671: Microsoft Office Excel Remote Code Execution Vulnerability, published 2007-02-03. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-08-12. EPSS: 43.2% chance of exploitation in the next 30 days. Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack…
CVE-2005-2127, published 2005-08-19. High severity, CVSS 7.5. EPSS: 63.7% chance of exploitation in the next 30 days. Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that…
CVE-2003-0347, published 2003-10-20. High severity, CVSS 10.0. EPSS: 54.9% chance of exploitation in the next 30 days. Heap-based buffer overflow in VBE.DLL and VBE6.DLL of Microsoft Visual Basic for Applications (VBA) SDK 5.0 through 6.3 allows remote attackers to execute arbitrary code via a document with a long ID…
CVE-2008-4255, published 2008-12-10. High severity, CVSS 9.3. EPSS: 53.7% chance of exploitation in the next 30 days. Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, Visual…
CVE-2004-0200, published 2004-09-28. High severity, CVSS 9.3. EPSS: 49% chance of exploitation in the next 30 days. Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with…
CVE-2006-3864, published 2006-10-10. High severity, CVSS 9.3. EPSS: 33.8% chance of exploitation in the next 30 days. Unspecified vulnerability in mso.dll in Microsoft Office 2000, XP, and 2003, and Microsoft PowerPoint 2000, XP, and 2003, allows remote user-assisted attackers to execute arbitrary code via a…
CVE-2008-1088, published 2008-04-08. High severity, CVSS 9.3. EPSS: 31.9% chance of exploitation in the next 30 days. Microsoft Project 2000 Service Release 1, 2002 SP1, and 2003 SP2 allows user-assisted remote attackers to execute arbitrary code via a crafted Project file, related to improper validation of "memory…
CVE-2004-0848, published 2005-02-08. High severity, CVSS 7.5. EPSS: 27.5% chance of exploitation in the next 30 days. Buffer overflow in Microsoft Office XP allows remote attackers to execute arbitrary code via a link with a URL file location containing long inputs after (1) "%00 (null byte) in .doc filenames or (2)…
CVE-2009-2501, published 2009-10-14. High severity, CVSS 9.3. EPSS: 26.7% chance of exploitation in the next 30 days. Heap-based buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1,…
CVE-2009-2500, published 2009-10-14. High severity, CVSS 9.3. EPSS: 23.6% chance of exploitation in the next 30 days. Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002…

Latest

CVE-2020-1322, published 2020-06-09. Medium severity, CVSS 6.5. EPSS: 5.5% chance of exploitation in the next 30 days. An information disclosure vulnerability exists when Microsoft Project reads out of bound memory due to an uninitialized variable, aka 'Microsoft Project Information Disclosure Vulnerability'.
CVE-2020-0760, published 2020-04-15. High severity, CVSS 8.8. EPSS: 8.8% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when Microsoft Office improperly loads arbitrary type libraries, aka 'Microsoft Office Remote Code Execution Vulnerability'. This CVE ID is unique from…
CVE-2019-1264, published 2019-09-11. High severity, CVSS 7.8. EPSS: 3.8% chance of exploitation in the next 30 days. A security feature bypass vulnerability exists when Microsoft Office improperly handles input, aka 'Microsoft Office Security Feature Bypass Vulnerability'.
CVE-2018-8575, published 2018-11-14. High severity, CVSS 7.8. EPSS: 19.5% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Microsoft Project software when it fails to properly handle objects in memory, aka "Microsoft Project Remote Code Execution Vulnerability." This…
CVE-2015-2503, published 2015-11-11. High severity, CVSS 9.3. EPSS: 16.5% chance of exploitation in the next 30 days. Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2007 IME (Japanese)…
CVE-2009-3126, published 2009-10-14. High severity, CVSS 9.3. EPSS: 23.5% chance of exploitation in the next 30 days. Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002…
CVE-2009-2528, published 2009-10-14. High severity, CVSS 9.3. EPSS: 20.5% chance of exploitation in the next 30 days. GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art Property Tables, which allows remote attackers to execute arbitrary code via a crafted Office document that…
CVE-2009-2504, published 2009-10-14. High severity, CVSS 9.3. EPSS: 21% chance of exploitation in the next 30 days. Multiple integer overflows in unspecified APIs in GDI+ in Microsoft .NET Framework 1.1 SP1, .NET Framework 2.0 SP1 and SP2, Windows XP SP2 and SP3, Windows Server 2003 SP2, Vista Gold and SP1, Server…
CVE-2009-2503, published 2009-10-14. High severity, CVSS 9.3. EPSS: 22.2% chance of exploitation in the next 30 days. GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Windows Server 2003 SP2, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio…
CVE-2009-2502, published 2009-10-14. High severity, CVSS 8.1. EPSS: 22% chance of exploitation in the next 30 days. Buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002…