CVE-2016-0139

CVE-2016-0139 is a memory corruption vulnerability in Microsoft Office products (Excel 2010 SP2, Word for Mac 2011, Excel Viewer) that enables remote code execution when a crafted Office document is opened. Multiple connected sources confirm it stems from improper handling of objects in memory, a...

CVE-2010-1248

CVE-2010-1248 affects Microsoft Office Excel 2002 SP3 (and Excel 2004 for Mac) due to parsing errors in HFPicture and WOPT records, causing heap/buffer memory corruption and potential remote code execution. The vulnerability arises when opening specially crafted Excel files containing malformed H...

CVE-2011-0098

CVE-2011-0098 corresponds to a remote code execution vulnerability in Microsoft Office Excel. The issue is a buffer/heap overflow in parsing the Label record (Excel file format), allowing remote attackers to run arbitrary code by convincing a user to open a malicious XLS file. Affected products i...

CVE-2018-8597

CVE-2018-8597 is a remote code execution vulnerability in Microsoft Excel/Office where improper handling of in-memory objects can allow arbitrary code execution in the context of the current user. Exploitation typically requires a user to open a specially crafted file, and affects Excel component...

CVE-2021-24068

CVE-2021-24068 is a Microsoft Excel remote code execution vulnerability. Publicly documented details in connected sources confirm Excel/RCE context and indicate affected Office products and versions addressed by security updates. Notable remediation: Microsoft security updates KB4493211 (Excel 20...

CVE-2025-21383

CVE-2025-21383 is an Microsoft Excel information-disclosure vulnerability affecting Office/Excel. The available sources (MSRC MS-Office security guidance, NC SC advisories, and related update notes) confirm Excel-specific information disclosure with potential access to sensitive data. Exploitatio...

CVE-2025-30376

CVE-2025-30376 affects Microsoft Excel (part of Microsoft Office). Root cause: heap-based buffer overflow in Excel. Impact: remote code execution locally. Remediation: security updates released by Microsoft (May 2025 updates; e.g., KB security updates) to fix the issue.

CVE-2026-44818

CVE-2026-44818 affects Microsoft Excel. A integer underflow (wrap/wraparound) in Excel is described as allowing an unauthorized attacker to execute code locally. The associated CVSS 3.1 vector indicates Local attack vector, high impact on confidentiality, integrity, and availability, with High pr...

CVE-2026-55037

CVE-2026-55037 affects Microsoft Office Excel. A heap-based buffer overflow in Excel allows an unauthenticated/unauthorized attacker to execute arbitrary code locally. The CVSSv3.1 vector indicates a local attack with low attack complexity, no privileges required, but user interaction is required...

CVE-2011-0979

CVE-2011-0979 affects Microsoft Excel and related Office components (including Mac versions) where errors parsing Office Art records in Excel spreadsheets allow remote code execution via a malformed object record (stray reference). Root cause is improper error handling during parsing of Office Ar...

CVE-2015-2375

Microsoft Excel ASLR Bypass (CVE-2015-2375) affects Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel Viewer 2007 SP3, and Excel Services on SharePoint Server 2010 SP2/2013 SP1. Root cause: crafted spreadsheet allows bypassing ASLR protection, enabling potential memory-disclosure or downst...

CVE-2016-0136

CVE-2016-0136 affects Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, and Excel Services on SharePoint Server 2007 SP3/2010 SP2. The root cause is memory corruption from improper handling of objects in memory, enabling remote code execution when a crafted Office document ...

CVE-2016-3359

CVE-2016-3359 affects Microsoft Office components (Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, Excel Viewer). The issue is a memory corruption vulnerability in Office that allows remote code execution via a crafted document. The CVE entry’s linked sources (NVD/NVD-variant and r...

CVE-2018-0907

CVE-2018-0907 is a security feature bypass in Microsoft Excel/Office products caused by how macro settings are enforced. Affected: Excel 2007 SP3, 2010 SP2, 2013 SP1, 2016, and Office 2016 for Mac, including Office 2016 Click-to-Run. Core issue: bypasses to macro security controls (security featu...

CVE-2008-4019

CVE-2008-4019 is an integer overflow in Excel’s REPT function used when parsing a formula within a cell, affecting multiple Windows and Mac Excel versions (e.g., 2000 SP3, 2002 SP3, 2003 SP2/SP3, 2007 Gold/SP1) and related viewers/compat packs. The vulnerability allows remote code execution if a ...

CVE-2025-32704

CVE-2025-32704 is a Microsoft Excel remote code execution vulnerability caused by a buffer over-read in Excel. The issue allows a local attacker to run arbitrary code on the affected system; CVSS indicates high impact with local access and no user interaction required in at least one metric set. ...

CVE-2026-40359

CVE-2026-40359 is a Microsoft Excel use-after-free remote code execution vulnerability. Description and NVD match: Excel component vulnerability allows an attacker to execute code locally due to a use-after-free condition. Exploitation status is not explicitly provided in the documents. Microsoft...

CVE-2026-81948

Microsoft Office Excel is affected by a heap-based buffer overflow that allows an unauthorized local attacker to execute arbitrary code. The vulnerability requires user interaction (e.g., opening a crafted file) but no prior privileges, and results in high impact to confidentiality, integrity, an...

CVE-2026-81959

A heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally when a user interacts with a crafted file. The CVSS 3.1 score is 7.8 (HIGH) , with a local attack vector, low complexity, no privileges required, and user interaction required, resulting...

CVE-2015-1682

Microsoft Office Multiple Remote Code Execution Vulnerabilities (CVE-2015-1682) affect Office/SharePoint components across Office 2010 SP2, Office 2013 SP1, Office for Mac 2011, Word/Excel/PowerPoint/SharePoint-related services, etc. Root cause: memory corruption triggered by processing a crafted...

CVE-2015-2378

CVE-2015-2378 is an Untrusted Search Path vulnerability in Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel Viewer 2007 SP3, and Office Compatibility Pack SP3. The root cause is DLL loading from the current working directory (Trojan horse DLL) that enables local privilege elevation. Documents indi...

CVE-2015-2423

CVE-2015-2423 is an “Unsafe Command Line Parameter Passing” vulnerability affecting a broad set of Windows OS versions (Vista through Windows 10) and Office apps (2007–2013) where a crafted command-line parameter to an Office app or Notepad can elevate from Low to Medium Integrity and disclose se...

CVE-2015-2523

CVE-2015-2523 describes a memory corruption vulnerability in Microsoft Office components (notably Excel 2007 SP3, 2010 SP2, 2013 SP1/RT SP1, Mac 2011/2016, Office Compatibility Pack SP3, and Excel Viewer) that allows remote code execution when processing crafted Office documents. The root cause i...

CVE-2018-8246

CVE-2018-8246 affects Microsoft Excel and related Office components. The connected advisories describe an information-disclosure vulnerability caused by the inclusion of uninitialized memory when processing parsed expressions in FORMULA records within Excel workbooks, allowing disclosure of sensi...

CVE-2020-17066

Mode C CVE-2020-17066 affects Microsoft Excel (Office). The connected sources confirm a Remote Code Execution vulnerability in Excel, with Microsoft’s advisory and related security updates addressing CVE-2020-17066 among a set of Excel-related CVEs. The CVSS data present in the documents indicate...

CVE-2025-29977

CVE-2025-29977 is a Microsoft Excel remote code execution vulnerability caused by a use-after-free in Excel. Exploitation can allow an attacker with local access to execute arbitrary code; user interaction is required per the CVSS, with high impact on confidentiality, integrity and availability. ...

CVE-2026-55041

CVE-2026-55041 is a heap-based buffer overflow in Microsoft Office Excel that can allow a local attacker to execute arbitrary code. The issue affects Excel (and is reflected in the overall Office ecosystem advisories) and arises from a heap overflow in a component used by Excel. The CVSS v3.1 vec...

CVE-2010-1245

CVE-2010-1245 is a remote code execution vulnerability in Microsoft Office Excel involving a malformed SxView record that could be triggered by opening a crafted Excel file. Affected products include Excel 2002 SP3, Excel 2004 for Mac, Excel 2008 for Mac, and the Open XML File Format Converter fo...

CVE-2011-0980

CVE-2011-0980 corresponds to a memory corruption flaw in Microsoft Office that arises when parsing Office Art objects, enabling remote code execution via a crafted file. It affects Excel/Office components across Windows and Mac builds listed in the initial document (Excel 2002/2003, Office for Ma...

CVE-2017-8502

CVE-2017-8502 is a Microsoft Office memory corruption vulnerability described in connected CNVD entries as affecting Office components (e.g., Word/Excel/PowerPoint) through improper handling of objects in memory. A remote attacker can trigger a vulnerability by luring a user to open a specially c...

CVE-2025-21386

CVE-2025-21386 is documented as a Microsoft Excel remote code execution vulnerability associated with the February 2025 Office security updates. The MSRC advisory notes that updates address multiple Office Excel flaws (including 21386) and references security updates KB5002679 (Office Online Serv...

CVE-2025-30383

CVE-2025-30383 is a Microsoft Excel remote code execution vulnerability caused by a type confusion issue in Excel. The impact is local code execution with high confidentiality/integrity/availability concerns (CVSS 7.8, LOCAL, USER INTERACTION REQUIRED). Microsoft has released May 2025 security up...

CVE-2026-26109

CVE-2026-26109 concerns a Microsoft Excel remote code execution vulnerability. The entry identifies Excel as affected and assigns a high impact on confidentiality, integrity, and availability per CVSS 3.1 metrics. The advisory notes a official fix is available, with an attack vector described as ...

CVE-2026-55044

CVE-2026-55044: Out-of-bounds read in Microsoft Office Excel; vulnerability allows a local attacker to execute code. Affected product: Microsoft Office Excel. Root cause: out-of-bounds read (details not expanded in the provided docs). Impact: remote code execution on the local host with high seve...

CVE-2015-2521

CVE-2015-2521 is a memory corruption vulnerability in Microsoft Office components (Excel 2007 SP3/2010 SP2, Office Compatibility Pack, Excel Viewer) that allows remote code execution when processing specially crafted Office documents. Public sources confirm in-the-wild exploitation for this famil...

CVE-2016-3362

CVE-2016-3362 and CVE-2016-3365 are memory‑corruption vulnerabilities in Microsoft Office components (notably Excel across multiple versions and Office/SharePoint services) that allow remote code execution via a crafted document. The root cause is memory handling flaws in Office components when p...

CVE-2016-7236

CVE-2016-7236 affects Microsoft Office components, notably Excel 2010 SP2, Excel for Mac 2011, Excel 2016 for Mac, and Excel Services on SharePoint Server 2010 SP2. The root cause is a memory handling flaw that allows remote code execution when a user opens a specially crafted Office document, wi...

CVE-2018-8598

CVE-2018-8598 is an information disclosure vulnerability in Microsoft Excel where memory contents can be exposed. Affected products include Office 365 ProPlus, Microsoft Office, and Microsoft Excel. The root cause is that Excel improperly discloses its memory contents. According to the provided d...

CVE-2025-21390

CVE-2025-21390 corresponds to a Microsoft Excel remote code execution vulnerability. The issue affects Excel components in Office, with the root cause described as a code execution flaw in the Excel-related files (e.g., Excel.exe and related XLL/addin components) that could let an attacker run ar...

CVE-2026-32188

CVE-2026-32188 appears to be an information-disclosure vulnerability in Microsoft Excel. The entry lists Excel as the affected product and indicates the vulnerability is exploitable locally with user interaction required, and it has high impact on confidentiality and availability. The CVSSv3.1 ve...

CVE-2026-45469

CVE-2026-45469 affects Microsoft Excel (Office) and is caused by an integer underflow/wraparound in Excel. The vulnerability can allow a local attacker to execute code on the affected system; the CVSS indicates LOCAL access, required user interaction, and high impact to confidentiality, integrity...

CVE-2026-81957

CVE-2026-81957 is an out-of-bounds read vulnerability in Microsoft Office Excel that allows an unauthorized, local attacker to execute code on the system. The attack requires user interaction (e.g., opening a crafted file) but no prior privileges. Microsoft rates the CVSS 3.1 score at 7.8 (HIGH) ...

CVE-2018-1011

CVE-2018-1027/1029/1011 describe a remote code execution in Microsoft Excel when Excel improperly handles in-memory objects. Affected: Microsoft Excel (and Office components in some entries). Root cause: incorrect handling of objects in memory leading to memory corruption that enables code execut...

CVE-2026-81954

CVE-2026-81954 is a use-after-free vulnerability in Microsoft Office Excel that allows an unauthorized attacker to execute code locally . The attack requires user interaction and no prior privileges, with a CVSS 3.1 score of 7.8 (HIGH) , reflecting full impact on confidentiality, integrity, and a...

CVE-2008-0115

CVE-2008-0115 : A remote-code-execution vulnerability in Microsoft Excel’s Formula Parsing affects Excel 2000 SP3–2007, Excel Viewer 2003, the Office Compatibility Pack, and Office for Mac 2004. The issue arises from improper handling of malformed formulas, allowing a user-assisted attacker to tr...

CVE-2008-3471

CVE-2008-3471 is a stack-based buffer overflow in Microsoft Excel’s BIFF file format parsing, triggered by a malformed record in a .xls file. Affected products include Excel 2000 SP3, 2002 SP3, 2003 SP2/SP3, 2007 Gold/SP1, Excel Viewer (2003 SP3) and related Mac components, as well as the Open XM...

CVE-2009-3127

CVE-2009-3127 (Excel Cache Memory Corruption) is a remote code execution vulnerability in Microsoft Office Excel variants: Excel 2002 SP3, 2003 SP3, 2004/2008 for Mac, Open XML File Format Converter for Mac, and Excel Viewer 2003 SP3. It stems from improper parsing of the Excel file format, allow...

CVE-2015-6122

CVE-2015-6122 is part of the MS15-131 memory corruption family affecting multiple Microsoft Office products. The connected Nessus plugin (MS15-131) links CVE-2015-6122 to remote code execution via crafted Office documents, with Mac OS X Office versions (MACOSX_MS15-131_OFFICE.NASL) and Office for...

CVE-2016-3381

Microsoft Excel 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, 2016, Office Compatibility Pack SP3, and Excel Viewer are affected by CVE-2016-3381, a memory-corruption vulnerability in Office components that allows remote code execution via a crafted document. The CNVD entry corroborates a remote att...

CVE-2024-49029

CVE-2024-49029 : Microsoft Excel Remote Code Execution vulnerability observed in multiple sources. Affected product: Microsoft Excel (Office 2016/MCU context). Reported fix: security update KB5002653 for Excel 2016 (MSKB), which addresses several CVEs including CVE-2024-49029; notes that the MSI-...