Microsoft Visio vulnerabilities

54 CVEs affecting Microsoft Visio, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-38016, published 2024-09-19.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2016-3235: Microsoft Office OLE DLL Side Loading Vulnerability, published 2016-06-16. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 43.3% chance of exploitation in the next 30 days. Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading, which allows local users to gain privileges via a crafted…
• CVE-2007-0671: Microsoft Office Excel Remote Code Execution Vulnerability, published 2007-02-03. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-08-12. EPSS: 43.2% chance of exploitation in the next 30 days. Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack…
• CVE-2010-1681, published 2010-05-06. High severity, CVSS 7.6. EPSS: 67.3% chance of exploitation in the next 30 days. Buffer overflow in VISIODWG.DLL before 10.0.6880.4 in Microsoft Office Visio allows user-assisted remote attackers to execute arbitrary code via a crafted DXF file, a different vulnerability than…
• CVE-2005-2127, published 2005-08-19. High severity, CVSS 7.5. EPSS: 63.7% chance of exploitation in the next 30 days. Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that…
• CVE-2003-0347, published 2003-10-20. High severity, CVSS 10.0. EPSS: 54.9% chance of exploitation in the next 30 days. Heap-based buffer overflow in VBE.DLL and VBE6.DLL of Microsoft Visual Basic for Applications (VBA) SDK 5.0 through 6.3 allows remote attackers to execute arbitrary code via a document with a long ID…
• CVE-2007-5348, published 2008-09-11. High severity, CVSS 9.3. EPSS: 52.9% chance of exploitation in the next 30 days. Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft…
• CVE-2008-3013, published 2008-09-11. High severity, CVSS 9.3. EPSS: 52.1% chance of exploitation in the next 30 days. gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft…
• CVE-2004-0200, published 2004-09-28. High severity, CVSS 9.3. EPSS: 49% chance of exploitation in the next 30 days. Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with…
• CVE-2008-3015, published 2008-09-11. High severity, CVSS 9.3. EPSS: 39.3% chance of exploitation in the next 30 days. Integer overflow in gdiplus.dll in GDI+ in Microsoft Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image…
• CVE-2008-3014, published 2008-09-11. High severity, CVSS 9.3. EPSS: 36.7% chance of exploitation in the next 30 days. Buffer overflow in gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3,…

Latest

• CVE-2024-38016, published 2024-09-19. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2024-43463, published 2024-09-10. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2024-20673, published 2024-02-13. High severity, CVSS 7.8. EPSS: 1.2% chance of exploitation in the next 30 days. Microsoft Office Remote Code Execution Vulnerability
• CVE-2023-21741, published 2023-01-10. High severity, CVSS 7.1. EPSS: 1.8% chance of exploitation in the next 30 days. Microsoft Office Visio Information Disclosure Vulnerability
• CVE-2023-21737, published 2023-01-10. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2023-21736, published 2023-01-10. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2022-44695, published 2022-12-13. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2022-38010, published 2022-09-13. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. Microsoft Office Visio Remote Code Execution Vulnerability
• CVE-2021-27055, published 2021-03-11. High severity, CVSS 7.0. EPSS: 2.5% chance of exploitation in the next 30 days. Microsoft Visio Security Feature Bypass Vulnerability
• CVE-2020-0760, published 2020-04-15. High severity, CVSS 8.8. EPSS: 8.8% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when Microsoft Office improperly loads arbitrary type libraries, aka 'Microsoft Office Remote Code Execution Vulnerability'. This CVE ID is unique from…