CVE-2018-0853: Improper Initialization

Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run C2R allow an information disclosure vulnerability, due to how Office initializes the affected variable, aka "Microsoft Office Information Disclosure Vulnerability"...

CVE-2018-0851: Out-of-bounds Write

Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run C2R allow a remote code execution vulnerability, due to how Office handles objects in memory, aka "Microsoft Offi...

PT-2018-1062

Name of the Vulnerable Software and Affected Versions Microsoft Outlook versions 2007 SP3 through 2016 Microsoft Office 2016 Click-to-Run C2R Description The issue is caused by a buffer overflow in memory, allowing a remote attacker to execute arbitrary code. The vulnerability exists due to how t...

Information disclosure

Microsoft Office 2016 Click-to-Run C2R allows an information disclosure vulnerability due to the way Microsoft Office enforces DRM copy/paste permissions, aka "Microsoft Office Information Disclosure Vulnerability"...

CVE-2017-11939

Microsoft Office 2016 Click-to-Run C2R allows an information disclosure vulnerability due to the way Microsoft Office enforces DRM copy/paste permissions, aka "Microsoft Office Information Disclosure Vulnerability"...

CVE-2017-11935

CVE-2017-11935 is a Microsoft Office remote code execution vulnerability affecting Microsoft Excel in Office 2016 Click-to-Run. The issue stems from how Excel/Office handles objects in memory, allowing an attacker to craft an Excel document that triggers the flaw and executes arbitrary code in th...

CVE-2017-11939

CVE-2017-11939 affects Microsoft Office 2016 (Click-to-Run). The vulnerability is an information-disclosure flaw stemming from DRM copy/paste enforcement, potentially leaking a user’s private data (e.g., private key) from the certificate store or plaintext from DRM-protected emails/drafts. Affect...

PT-2017-3528

Name of the Vulnerable Software and Affected Versions: Microsoft Office 2016 Click-to-Run C2R Description: The issue is related to the improper handling of objects in memory, which can lead to remote code execution. This can be achieved by a remote attacker using a specially crafted file...

CVE-2017-11935: Improper Restriction of Operations within the Bounds of a Memory Buffer

Microsoft Office 2016 Click-to-Run C2R allows a remote code execution vulnerability due to the way files are handled in memory, aka "Microsoft Excel Remote Code Execution Vulnerability"...

CVE-2017-11884

Technical details about CVE-2017-11884 are not publicly provided in the connected documents; no specific affected products, versions, exploit vectors, or remediation are disclosed here. Monitor for updates.

Remote code execution

Microsoft Office 2016 Click-to-Run C2R and Microsoft Office 2016 for Mac allow an attacker to use a specially crafted file to perform actions in the security context of the current user, due to how Microsoft Office handles files in memory, aka "Microsoft Office Remote Code Execution Vulnerability...

PT-2017-3123

Name of the Vulnerable Software and Affected Versions Microsoft Office 2016 Click-to-Run C2R Microsoft Office 2016 for Mac Description The issue is related to how Microsoft Office handles files in memory, allowing an attacker to use a specially crafted file to perform actions in the security...

CVE-2016-0137

CVE-2016-0137 describes an information-disclosure/ASLR-bypass vulnerability in the Microsoft Office Click-to-Run (C2R) components for Office 2013 SP1 and Office 2016. The issue allows a local attacker with logon privileges to bypass ASLR by executing a specially crafted application, potentially l...