CVE-2017-0027

CVE-2017-0027 affects Microsoft Office products including Excel 2007 SP3, Excel 2010 SP2, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Services on SharePoint Server 2013 SP1. Description: information disclosure from process memory when processing a crafted Office docume...

CVE-2017-8632

CVE-2017-8632 describes a remote code execution vulnerability in Microsoft Office products caused by improper handling of in-memory objects (memory corruption). Affected are Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Web Apps 2013, Excel for Mac 2011, Excel 20...

CVE-2020-1504

CVE-2020-1504 is a remote code execution flaw in Microsoft Excel caused by improper handling of in-memory objects. The vulnerability allows arbitrary code execution in the caller’s context if a user opens a specially crafted Excel file. The NVD entry (CVSS:3.1 base score 8.8; impact high on confi...

CVE-2024-43106

Microsoft Excel on macOS (version 16.83) is vulnerable to a library-injection issue that lets a malicious app inject a library and piggyback on Excel’s entitlements to perform actions with the app’s permissions. The root cause is the combination of Hardened Runtime with com.apple.security.cs.disa...

CVE-2017-0194

CVE-2017-0194 affects Microsoft Excel 2007 SP3, Excel 2010 SP2 and Office Compatibility Pack SP2. It is an Information Disclosure vulnerability where crafted Office documents can cause memory objects to disclose sensitive memory contents due to improper handling of memory. Root cause: improper ha...

CVE-2017-8501

CVE-2017-8501 is described across connected CNVD/OpenVAS entries as a memory corruption vulnerability in Microsoft Office components (notably Word/Excel/SharePoint) that can be triggered by specially crafted files to yield remote code execution or DoS under the current user. The root cause cited ...

CVE-2018-8147

CVE-2018-8147 is a remote code execution vulnerability in Microsoft Excel (Office) tied to improper handling of in-memory objects. The issue could allow an attacker to run arbitrary code in the context of the current user, potentially taking control of the affected system, as described in multipl...

CVE-2018-8597

CVE-2018-8597 is a remote code execution vulnerability in Microsoft Excel/Office where improper handling of in-memory objects can allow arbitrary code execution in the context of the current user. Exploitation typically requires a user to open a specially crafted file, and affects Excel component...

CVE-2025-24075

Summary : CVE-2025-24075 is a stack-based buffer overflow in Microsoft Excel (Office) that allows local code execution. The vulnerability affects Excel components handling data/files and can lead to arbitrary code execution in the caller’s context when exploited locally with user interaction. Imp...

CVE-2025-24082

CVE-2025-24082 is a Microsoft Excel remote code execution vulnerability described as a use-after-free in Excel that can allow a local attacker to run arbitrary code. The CVE is confirmed by Microsoft’s MSRC entry (Microsoft Excel Remote Code Execution Vulnerability) and is referenced alongside re...

CVE-2016-7266

CVE-2016-7266 affects multiple Microsoft Office/Excel variants (Windows: Excel 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, 2016; macOS: Excel 2016) and the Office Compatibility Pack, Excel Viewer, and Excel for Mac. The root cause is mishandling of a registry check when running embedded content, d...

CVE-2025-29979

The CVE-2025-29979 entry concerns a heap-based buffer overflow in Microsoft Excel that enables local code execution. Affected software is Microsoft Excel (part of the Office suite); the root cause is a heap-based buffer overflow in Excel’s handling of certain inputs, which could allow an attacker...

CVE-2006-3877

PowerPoint Malformed Record Memory Corruption Vulnerability (CVE-2006-3877) affects multiple Office suites. A remote code execution flaw exists when PowerPoint opens a specially crafted file with malformed records, allowing an attacker to gain full control of the affected system if the user runs ...

CVE-2016-7265

CVE-2016-7265 affects Microsoft Office components (notably Excel 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, 2016, Office Compatibility Pack SP3, Excel Viewer, and Excel Services on SharePoint Server 2007 SP3/2010 SP2). The vulnerability is described as an information disclosure via an out-of-boun...

CVE-2010-0821

CVE-2010-0821 is identified in connected advisories as the Excel SXVIEW record parsing memory corruption vulnerability. It allows remote code execution if a user opens a specially crafted Excel file, due to improper parsing of SXVIEW structures. Exploitation requires user interaction (opening a c...

CVE-2025-21394

CVE-2025-21394 is a Microsoft Excel remote code execution vulnerability affecting Excel/Office components. Exploitation requires a user to open a crafted file and can lead to total compromise per the published CVSS: Local access, user interaction required, high impact. Remediation provided via Fe...

CVE-2011-0098

CVE-2011-0098 corresponds to a remote code execution vulnerability in Microsoft Office Excel. The issue is a buffer/heap overflow in parsing the Label record (Excel file format), allowing remote attackers to run arbitrary code by convincing a user to open a malicious XLS file. Affected products i...

CVE-2015-6038

CVE-2015-6038 affects Microsoft Office products including Excel 2007/2010/2013/2016 (Windows and Mac) and related components, as well as Excel Services on SharePoint Server and Office viewers. The vulnerability stems from memory corruption triggered by specially crafted Office documents, enabling...

CVE-2016-0136

CVE-2016-0136 affects Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, and Excel Services on SharePoint Server 2007 SP3/2010 SP2. The root cause is memory corruption from improper handling of objects in memory, enabling remote code execution when a crafted Office document ...

CVE-2016-3359

CVE-2016-3359 affects Microsoft Office components (Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, Excel Viewer). The issue is a memory corruption vulnerability in Office that allows remote code execution via a crafted document. The CVE entry’s linked sources (NVD/NVD-variant and r...

CVE-2021-24068

CVE-2021-24068 is a Microsoft Excel remote code execution vulnerability. Publicly documented details in connected sources confirm Excel/RCE context and indicate affected Office products and versions addressed by security updates. Notable remediation: Microsoft security updates KB4493211 (Excel 20...

CVE-2025-30379

CVE-2025-30379 is a Microsoft Excel/Office vulnerability described as a release of an invalid pointer or reference in Excel that allows an attacker to execute code locally. Public references (MSRC advisory and CVE records) corroborate Excel as the affected component and confirm a local code execu...

CVE-2010-1245

CVE-2010-1245 is a remote code execution vulnerability in Microsoft Office Excel involving a malformed SxView record that could be triggered by opening a crafted Excel file. Affected products include Excel 2002 SP3, Excel 2004 for Mac, Excel 2008 for Mac, and the Open XML File Format Converter fo...

CVE-2026-68802

CVE-2026-68802 describes an out-of-bounds read flaw in Microsoft Office Excel that can allow a local attacker to disclose information. The vulnerability affects Excel and is triggered locally, requiring user interaction per the CVSS:3.1 metrics (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). The root caus...

CVE-2010-1248

CVE-2010-1248 affects Microsoft Office Excel 2002 SP3 (and Excel 2004 for Mac) due to parsing errors in HFPicture and WOPT records, causing heap/buffer memory corruption and potential remote code execution. The vulnerability arises when opening specially crafted Excel files containing malformed H...

CVE-2015-2423

CVE-2015-2423 is an “Unsafe Command Line Parameter Passing” vulnerability affecting a broad set of Windows OS versions (Vista through Windows 10) and Office apps (2007–2013) where a crafted command-line parameter to an Office app or Notepad can elevate from Low to Medium Integrity and disclose se...

CVE-2018-0907

CVE-2018-0907 is a security feature bypass in Microsoft Excel/Office products caused by how macro settings are enforced. Affected: Excel 2007 SP3, 2010 SP2, 2013 SP1, 2016, and Office 2016 for Mac, including Office 2016 Click-to-Run. Core issue: bypasses to macro security controls (security featu...

CVE-2018-8598

CVE-2018-8598 is an information disclosure vulnerability in Microsoft Excel where memory contents can be exposed. Affected products include Office 365 ProPlus, Microsoft Office, and Microsoft Excel. The root cause is that Excel improperly discloses its memory contents. According to the provided d...

CVE-2015-2521

CVE-2015-2521 is a memory corruption vulnerability in Microsoft Office components (Excel 2007 SP3/2010 SP2, Office Compatibility Pack, Excel Viewer) that allows remote code execution when processing specially crafted Office documents. Public sources confirm in-the-wild exploitation for this famil...

CVE-2020-17066

Mode C CVE-2020-17066 affects Microsoft Excel (Office). The connected sources confirm a Remote Code Execution vulnerability in Excel, with Microsoft’s advisory and related security updates addressing CVE-2020-17066 among a set of Excel-related CVEs. The CVSS data present in the documents indicate...

CVE-2026-26133

CVE-2026-26133 involves an AI command injection vulnerability in Microsoft 365 Copilot that can lead to unauthorized disclosure of information over a network. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) indicates a network-accessible issue with no privileges required but user intera...

CVE-2016-0139

CVE-2016-0139 is a memory corruption vulnerability in Microsoft Office products (Excel 2010 SP2, Word for Mac 2011, Excel Viewer) that enables remote code execution when a crafted Office document is opened. Multiple connected sources confirm it stems from improper handling of objects in memory, a...

CVE-2016-3381

Microsoft Excel 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, 2016, Office Compatibility Pack SP3, and Excel Viewer are affected by CVE-2016-3381, a memory-corruption vulnerability in Office components that allows remote code execution via a crafted document. The CNVD entry corroborates a remote att...

CVE-2018-1011

CVE-2018-1027/1029/1011 describe a remote code execution in Microsoft Excel when Excel improperly handles in-memory objects. Affected: Microsoft Excel (and Office components in some entries). Root cause: incorrect handling of objects in memory leading to memory corruption that enables code execut...

CVE-2018-8246

CVE-2018-8246 affects Microsoft Excel and related Office components. The connected advisories describe an information-disclosure vulnerability caused by the inclusion of uninitialized memory when processing parsed expressions in FORMULA records within Excel workbooks, allowing disclosure of sensi...

CVE-2025-32704

CVE-2025-32704 is a Microsoft Excel remote code execution vulnerability caused by a buffer over-read in Excel. The issue allows a local attacker to run arbitrary code on the affected system; CVSS indicates high impact with local access and no user interaction required in at least one metric set. ...

CVE-2010-0257

CVE-2010-0257 is a remote code execution vulnerability in Microsoft Excel 2002 SP3 and Excel XP related to memory corruption when processing EntExU2 records in a crafted Excel file. Exploitation could allow an attacker to take full control of the affected system by convincing a user to open a mal...

CVE-2015-2376

CVE-2015-2376 affects multiple Microsoft Office components (Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1/RT SP1, Office for Mac 2011, Excel Viewer 2007 SP3, Office Compatibility Pack SP3, and Excel Services on SharePoint Server 2007 SP3/2010 SP2/2013 SP1). The vulnerability is a memory corrupti...

CVE-2015-2523

CVE-2015-2523 describes a memory corruption vulnerability in Microsoft Office components (notably Excel 2007 SP3, 2010 SP2, 2013 SP1/RT SP1, Mac 2011/2016, Office Compatibility Pack SP3, and Excel Viewer) that allows remote code execution when processing crafted Office documents. The root cause i...

CVE-2016-3363

CVE-2016-3363 affects Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer. The vulnerability is a memory-corruption flaw triggered by a crafted document, enabling remote code execution with the attacker gaining t...

CVE-2016-7236

CVE-2016-7236 affects Microsoft Office components, notably Excel 2010 SP2, Excel for Mac 2011, Excel 2016 for Mac, and Excel Services on SharePoint Server 2010 SP2. The root cause is a memory handling flaw that allows remote code execution when a user opens a specially crafted Office document, wi...

CVE-2017-8502

CVE-2017-8502 is a Microsoft Office memory corruption vulnerability described in connected CNVD entries as affecting Office components (e.g., Word/Excel/PowerPoint) through improper handling of objects in memory. A remote attacker can trigger a vulnerability by luring a user to open a specially c...

CVE-2018-1027

Microsoft Excel/Office are affected by CVE-2018-1027, a remote code execution vulnerability caused by improper handling of in-memory objects. The issue affects Excel and Office suites, enabling potential code execution when loaded with crafted data. CVSS references show a high-severity impact (C ...

CVE-2008-4019

CVE-2008-4019 is an integer overflow in Excel’s REPT function used when parsing a formula within a cell, affecting multiple Windows and Mac Excel versions (e.g., 2000 SP3, 2002 SP3, 2003 SP2/SP3, 2007 Gold/SP1) and related viewers/compat packs. The vulnerability allows remote code execution if a ...

CVE-2009-3127

CVE-2009-3127 (Excel Cache Memory Corruption) is a remote code execution vulnerability in Microsoft Office Excel variants: Excel 2002 SP3, 2003 SP3, 2004/2008 for Mac, Open XML File Format Converter for Mac, and Excel Viewer 2003 SP3. It stems from improper parsing of the Excel file format, allow...

CVE-2016-3362

CVE-2016-3362 and CVE-2016-3365 are memory‑corruption vulnerabilities in Microsoft Office components (notably Excel across multiple versions and Office/SharePoint services) that allow remote code execution via a crafted document. The root cause is memory handling flaws in Office components when p...

CVE-2025-21383

CVE-2025-21383 is an Microsoft Excel information-disclosure vulnerability affecting Office/Excel. The available sources (MSRC MS-Office security guidance, NC SC advisories, and related update notes) confirm Excel-specific information disclosure with potential access to sensitive data. Exploitatio...

CVE-2026-68805

CVE-2026-68805 affects Microsoft Excel (part of Microsoft Office) with a heap-based buffer overflow leading to remote code execution. The connected documents consistently describe it as a heap-based overflow in Excel that enables an attacker to run arbitrary code, with a CVSSv3.1 base score of 7....

CVE-2026-68816

CVE-2026-68816 is a stack-based buffer overflow in Microsoft Excel that enables local code execution by an unauthenticated attacker. The affected product is Microsoft Office Excel; the root cause is a stack-based overflow in Excel’s handling that can be triggered locally. The CVSS 3.1 base score ...

CVE-2011-0980

CVE-2011-0980 corresponds to a memory corruption flaw in Microsoft Office that arises when parsing Office Art objects, enabling remote code execution via a crafted file. It affects Excel/Office components across Windows and Mac builds listed in the initial document (Excel 2002/2003, Office for Ma...