CVE-2018-8627

CVE-2018-8627 (Microsoft Excel information disclosure) : An information-disclosure flaw in Excel when reading memory out of bounds due to an uninitialized variable. Affected products include Microsoft Office/Excel and related viewers. Exploitation requires opening a specially crafted file; succes...

CVE-2020-17065

CVE-2020-17065 is a Microsoft Excel remote code execution vulnerability. Based on connected documents, the issue is tied to Microsoft Office Excel components and is addressed in November 2020 security updates (Office product family including Excel 2010/2013 and related C2R deployments). Nessus/NV...

CVE-2010-0822

CVE-2010-0822 describes a stack-based overflow in Excel’s object (OBJ) record parser. The vulnerability permits remote code execution via a specially crafted Excel file and affects Excel 2002 SP3, Office 2004/2008 for Mac, and Open XML File Format Converter for Mac (per the initial entry). Public...

CVE-2017-0052

The CVE affects Microsoft Office components: Office Compatibility Pack SP3, Excel 2007 SP3, Excel Viewer, and Excel Services on SharePoint Server 2007 SP3. It is a memory corruption vulnerability exploitable via a crafted document, potentially allowing remote code execution or denial of service. ...

CVE-2020-1497

CVE-2020-1497 is an information disclosure vulnerability in Microsoft Excel. The issue arises when Excel improperly discloses contents of memory due to how objects are handled in memory; an attacker could craft a document and convince a user to open it to exfiltrate memory contents. The core root...

CVE-2016-3358

CVE-2016-3358 affects Microsoft Office and Excel components across Windows and Mac platforms (Excel 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, 2016; Office Online Server; Office Viewer; SharePoint Excel Services). The vulnerability is described as a memory corruption in Office applications that a...

CVE-2018-8502

CVE-2018-8502 is an Excel remote code execution vulnerability in Microsoft Excel (and adjacent Office components) caused by improper handling of objects in Protected View. The issue allows arbitrary code execution in the context of the current user, with the attacker potentially gaining full cont...

CVE-2025-24075

Summary : CVE-2025-24075 is a stack-based buffer overflow in Microsoft Excel (Office) that allows local code execution. The vulnerability affects Excel components handling data/files and can lead to arbitrary code execution in the caller’s context when exploited locally with user interaction. Imp...

CVE-2026-68793

CVE-2026-68793 involves an out-of-bounds read in Microsoft Office Excel that enables an unauthorized attacker to execute code locally. Affected software: Microsoft Excel. Vulnerable component: Excel handling leading to a out-of-bounds read; root cause stated as such. Impact: local code execution ...

CVE-2011-0105

CVE-2011-0105 describes a buffer overflow in Microsoft Excel-related components caused by obtaining a length value from an uninitialized memory location, enabling remote code execution via a crafted Excel file. Affected products listed in the provided sources include Excel 2002 SP3, Office for Ma...

CVE-2015-2377

CVE-2015-2377 affects Microsoft Office components (Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, and Office Compatibility Pack SP3) and is caused by memory corruption when parsing crafted Office documents, enabling remote code execution or a denial of service. Multiple connec...

CVE-2025-29979

The CVE-2025-29979 entry concerns a heap-based buffer overflow in Microsoft Excel that enables local code execution. Affected software is Microsoft Excel (part of the Office suite); the root cause is a heap-based buffer overflow in Excel’s handling of certain inputs, which could allow an attacker...

CVE-2026-70328

CVE-2026-70328 affects Microsoft Excel, with an out-of-bounds read that enables information disclosure over a network. The CVSSv3.1 base score is 6.5 (Medium); attack vector Network, attack complexity Low, privileges Required None, user interaction Required; confidentiality impact High. Connected...

CVE-2015-2376

CVE-2015-2376 affects multiple Microsoft Office components (Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1/RT SP1, Office for Mac 2011, Excel Viewer 2007 SP3, Office Compatibility Pack SP3, and Excel Services on SharePoint Server 2007 SP3/2010 SP2/2013 SP1). The vulnerability is a memory corrupti...

CVE-2016-7265

CVE-2016-7265 affects Microsoft Office components (notably Excel 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, 2016, Office Compatibility Pack SP3, Excel Viewer, and Excel Services on SharePoint Server 2007 SP3/2010 SP2). The vulnerability is described as an information disclosure via an out-of-boun...

CVE-2017-8501

CVE-2017-8501 is described across connected CNVD/OpenVAS entries as a memory corruption vulnerability in Microsoft Office components (notably Word/Excel/SharePoint) that can be triggered by specially crafted files to yield remote code execution or DoS under the current user. The root cause cited ...

CVE-2020-1504

CVE-2020-1504 is a remote code execution flaw in Microsoft Excel caused by improper handling of in-memory objects. The vulnerability allows arbitrary code execution in the caller’s context if a user opens a specially crafted Excel file. The NVD entry (CVSS:3.1 base score 8.8; impact high on confi...

CVE-2025-24082

CVE-2025-24082 is a Microsoft Excel remote code execution vulnerability described as a use-after-free in Excel that can allow a local attacker to run arbitrary code. The CVE is confirmed by Microsoft’s MSRC entry (Microsoft Excel Remote Code Execution Vulnerability) and is referenced alongside re...

CVE-2006-3877

PowerPoint Malformed Record Memory Corruption Vulnerability (CVE-2006-3877) affects multiple Office suites. A remote code execution flaw exists when PowerPoint opens a specially crafted file with malformed records, allowing an attacker to gain full control of the affected system if the user runs ...

CVE-2017-0194

CVE-2017-0194 affects Microsoft Excel 2007 SP3, Excel 2010 SP2 and Office Compatibility Pack SP2. It is an Information Disclosure vulnerability where crafted Office documents can cause memory objects to disclose sensitive memory contents due to improper handling of memory. Root cause: improper ha...

CVE-2021-27054

CVE-2021-27054 is a Microsoft Excel remote code execution vulnerability documenting RCE in Excel/Office components. Public sources in connected docs reference March 2021 security updates for Office/Excel products (C2R deployments for March 2021; macOS and Office 2010/2019 variants) as the fix con...

CVE-2025-21394

CVE-2025-21394 is a Microsoft Excel remote code execution vulnerability affecting Excel/Office components. Exploitation requires a user to open a crafted file and can lead to total compromise per the published CVSS: Local access, user interaction required, high impact. Remediation provided via Fe...

CVE-2026-68796

CVE-2026-68796 describes a heap-based buffer overflow in Microsoft Excel that can lead to local code execution. Impact per CVSS: HIGH, with local attack vector, required user interaction, and high confidentiality/integrity/availability impact. Affected product is Microsoft Excel; root cause is a ...

CVE-2017-8632

CVE-2017-8632 describes a remote code execution vulnerability in Microsoft Office products caused by improper handling of in-memory objects (memory corruption). Affected are Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Web Apps 2013, Excel for Mac 2011, Excel 20...

CVE-2018-8597

CVE-2018-8597 is a remote code execution vulnerability in Microsoft Excel/Office where improper handling of in-memory objects can allow arbitrary code execution in the context of the current user. Exploitation typically requires a user to open a specially crafted file, and affects Excel component...

CVE-2020-17067

CVE-2020-17067 refers to a Microsoft Excel Security Feature Bypass vulnerability. Affected product: Microsoft Excel/Office components; root cause: security feature bypass in Excel. CVSSv3.1 base score 7.8 (HIGH) with LOCAL attack vector, LOW complexity, NONE privileges, user interaction REQUIRED;...

CVE-2026-44817

CVE-2026-44817 is an Excel vulnerability: an integer underflow (wrap/wraparound) in Microsoft Excel could allow a local attacker to execute code. Exploitation details in the public metrics show local access with user interaction required and high impact on confidentiality, integrity, and availabi...

CVE-2018-8147

CVE-2018-8147 is a remote code execution vulnerability in Microsoft Excel (Office) tied to improper handling of in-memory objects. The issue could allow an attacker to run arbitrary code in the context of the current user, potentially taking control of the affected system, as described in multipl...

CVE-2025-30379

CVE-2025-30379 is a Microsoft Excel/Office vulnerability described as a release of an invalid pointer or reference in Excel that allows an attacker to execute code locally. Public references (MSRC advisory and CVE records) corroborate Excel as the affected component and confirm a local code execu...

CVE-2026-26133

CVE-2026-26133 involves an AI command injection vulnerability in Microsoft 365 Copilot that can lead to unauthorized disclosure of information over a network. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) indicates a network-accessible issue with no privileges required but user intera...

CVE-2016-7266

CVE-2016-7266 affects multiple Microsoft Office/Excel variants (Windows: Excel 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, 2016; macOS: Excel 2016) and the Office Compatibility Pack, Excel Viewer, and Excel for Mac. The root cause is mishandling of a registry check when running embedded content, d...

CVE-2010-0821

CVE-2010-0821 is identified in connected advisories as the Excel SXVIEW record parsing memory corruption vulnerability. It allows remote code execution if a user opens a specially crafted Excel file, due to improper parsing of SXVIEW structures. Exploitation requires user interaction (opening a c...

CVE-2011-0098

CVE-2011-0098 corresponds to a remote code execution vulnerability in Microsoft Office Excel. The issue is a buffer/heap overflow in parsing the Label record (Excel file format), allowing remote attackers to run arbitrary code by convincing a user to open a malicious XLS file. Affected products i...

CVE-2015-6038

CVE-2015-6038 affects Microsoft Office products including Excel 2007/2010/2013/2016 (Windows and Mac) and related components, as well as Excel Services on SharePoint Server and Office viewers. The vulnerability stems from memory corruption triggered by specially crafted Office documents, enabling...

CVE-2026-68811

Microsoft Excel is affected by CVE-2026-68811 through a type-confusion vulnerability that allows local code execution when accessing a resource with incompatible type. The root cause is a type-confusion issue in a component used by Excel; the vulnerability enables an unauthorized attacker to exec...

CVE-2010-1248

CVE-2010-1248 affects Microsoft Office Excel 2002 SP3 (and Excel 2004 for Mac) due to parsing errors in HFPicture and WOPT records, causing heap/buffer memory corruption and potential remote code execution. The vulnerability arises when opening specially crafted Excel files containing malformed H...

CVE-2016-3359

CVE-2016-3359 affects Microsoft Office components (Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, Excel Viewer). The issue is a memory corruption vulnerability in Office that allows remote code execution via a crafted document. The CVE entry’s linked sources (NVD/NVD-variant and r...

CVE-2026-68795

Microsoft Excel (Office) is affected by a stack-based buffer overflow (CVE-2026-68795) that could allow an attacker to execute code locally. The CVSS v3.1 score is 7.8 (HIGH) with LOCAL attack vector, requiring user interaction. The available documents do not specify a patched version or workarou...

CVE-2018-0907

CVE-2018-0907 is a security feature bypass in Microsoft Excel/Office products caused by how macro settings are enforced. Affected: Excel 2007 SP3, 2010 SP2, 2013 SP1, 2016, and Office 2016 for Mac, including Office 2016 Click-to-Run. Core issue: bypasses to macro security controls (security featu...

CVE-2020-17066

Mode C CVE-2020-17066 affects Microsoft Excel (Office). The connected sources confirm a Remote Code Execution vulnerability in Excel, with Microsoft’s advisory and related security updates addressing CVE-2020-17066 among a set of Excel-related CVEs. The CVSS data present in the documents indicate...

CVE-2026-68803

CVE-2026-68803: A type confusion in Microsoft Excel enables local code execution. Affects Microsoft Excel (Office). Exploitation details: requires user interaction and local access per CVSS, with high impact on confidentiality, integrity, and availability. Root cause: resource access using an inc...

CVE-2010-0257

CVE-2010-0257 is a remote code execution vulnerability in Microsoft Excel 2002 SP3 and Excel XP related to memory corruption when processing EntExU2 records in a crafted Excel file. Exploitation could allow an attacker to take full control of the affected system by convincing a user to open a mal...

CVE-2010-1245

CVE-2010-1245 is a remote code execution vulnerability in Microsoft Office Excel involving a malformed SxView record that could be triggered by opening a crafted Excel file. Affected products include Excel 2002 SP3, Excel 2004 for Mac, Excel 2008 for Mac, and the Open XML File Format Converter fo...

CVE-2018-8246

CVE-2018-8246 affects Microsoft Excel and related Office components. The connected advisories describe an information-disclosure vulnerability caused by the inclusion of uninitialized memory when processing parsed expressions in FORMULA records within Excel workbooks, allowing disclosure of sensi...

CVE-2021-24068

CVE-2021-24068 is a Microsoft Excel remote code execution vulnerability. Publicly documented details in connected sources confirm Excel/RCE context and indicate affected Office products and versions addressed by security updates. Notable remediation: Microsoft security updates KB4493211 (Excel 20...

CVE-2025-29977

CVE-2025-29977 is a Microsoft Excel remote code execution vulnerability caused by a use-after-free in Excel. Exploitation can allow an attacker with local access to execute arbitrary code; user interaction is required per the CVSS, with high impact on confidentiality, integrity and availability. ...

CVE-2025-30376

CVE-2025-30376 affects Microsoft Excel (part of Microsoft Office). Root cause: heap-based buffer overflow in Excel. Impact: remote code execution locally. Remediation: security updates released by Microsoft (May 2025 updates; e.g., KB security updates) to fix the issue.

CVE-2025-32704

CVE-2025-32704 is a Microsoft Excel remote code execution vulnerability caused by a buffer over-read in Excel. The issue allows a local attacker to run arbitrary code on the affected system; CVSS indicates high impact with local access and no user interaction required in at least one metric set. ...

CVE-2015-2378

CVE-2015-2378 is an Untrusted Search Path vulnerability in Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel Viewer 2007 SP3, and Office Compatibility Pack SP3. The root cause is DLL loading from the current working directory (Trojan horse DLL) that enables local privilege elevation. Documents indi...

CVE-2015-2423

CVE-2015-2423 is an “Unsafe Command Line Parameter Passing” vulnerability affecting a broad set of Windows OS versions (Vista through Windows 10) and Office apps (2007–2013) where a crafted command-line parameter to an Office app or Notepad can elevate from Low to Medium Integrity and disclose se...