CVE-2010-0261

Microsoft Excel MDXSET Record Heap Overflow (CVE-2010-0261) is a remote-code-execution vulnerability affecting Excel 2007 SP1/SP2 and the Office Compatibility Pack for Word/Excel/PowerPoint 2007 File Formats SP1/SP2. The issue stems from parsing an MDXSET record that is broken into multiple recor...

CVE-2010-1251

CVE-2010-1251 corresponds to a remote code execution vulnerability in Microsoft Office Excel, specifically the Excel Record Stack Corruption vulnerability. Public sources in the connected set detail affected products including Excel 2002 SP3, Excel 2003/2002 line for Mac (Office 2004 for Mac) and...

CVE-2014-6360

CVE-2014-6360 affects Microsoft Office Excel 2007 SP3, Excel 2010 SP2, and the Office Compatibility Pack. The vulnerability arises from improper handling of objects in memory while parsing Office files, allowing a remote attacker to execute arbitrary code by convincing a user to open a specially ...

CVE-2018-8163

The CVE-2018-8163 entry concerns Microsoft Excel/Office information disclosure due to memory contents being improperly disclosed. Affected products include Excel (various Office suites) with the root cause described as memory contents disclosure; impact is information disclosure (confidentiality)...

CVE-2026-32199

CVE-2026-32199 affects Microsoft Excel (Office) with a use-after-free in Excel that enables local code execution by an attacker. The vulnerability is listed under Excel-related issues in multiple advisories and is addressed by security updates from Microsoft (e.g., KB5002855 for Office Online Ser...

CVE-2026-81392

CVE-2026-81392 is an out-of-bounds read vulnerability in Microsoft Office Excel that allows an unauthorized, local attacker to disclose information . The CVSS v3.1 score is 5.5 (MEDIUM) with a vector of AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, meaning exploitation requires user interaction and a loca...

CVE-2000-0597

The CVE-2000-0597 entry concerns Microsoft Office 2000 (Excel and PowerPoint) and PowerPoint 97. The vulnerability arises because these products are marked as safe for scripting, enabling a remote attacker to coax Internet Explorer or some email clients to save files to arbitrary locations via th...

CVE-2006-1306

CVE-2006-1306 is a Microsoft Excel remote code execution vulnerability in the Malformed OBJECT record. A crafted .xls file can cause an attacker-controlled function pointer to execute arbitrary code when opened, enabling code execution in the user’s context. The issue affects Office/Excel 2000–20...

CVE-2007-3030

CVE-2007-3030 maps to a Workbook Memory Corruption vulnerability in Microsoft Excel affecting multiple products (Excel 2000 SP3, 2002 SP3, 2003 SP2, and 2003 Viewer; also Mac OS X Excel 2004 per MS07-036). The issue arises when handling malformed Excel workbooks, leading to memory corruption that...

CVE-2011-1277

CVE-2011-1277 affects Microsoft Excel 2002 SP3, Office 2008 for Mac, and the Open XML File Format Converter for Mac. The issue is due to improper validation of record information during Excel spreadsheet parsing, enabling a crafted file to cause remote code execution or memory corruption. The vul...

CVE-2012-5672

CVE-2012-5672 affects Microsoft Excel Viewer (Xlview.exe) and Excel in Office 2007. A crafted .xls spreadsheet can trigger a read access violation, causing an application crash (denial of service). The description and connected sources consistently describe the issue as a DoS via a malformed Exce...

CVE-2025-62199

CVE-2025-62199 is a Microsoft Office remote code execution/use-after-free vulnerability. The CVE affects multiple Office components (notably Office and Excel) due to a memory-management flaw described as a use-after-free in Office, enabling a locally authenticated attacker to run arbitrary code. ...

CVE-2025-62553

CVE-2025-62553 affects Microsoft Excel (Office) with a use-after-free in Excel leading to local arbitrary code execution. The vulnerability, tracked across multiple advisories (CNVD/CNNVD/MSVCVE/NCSc) and confirmed by MSRC, is mitigated by December 2025 Office security updates (e.g., KB5002818/KB...

CVE-2026-70327

CVE-2026-70327: Out-of-bounds read in Microsoft Office Excel allows an unauthenticated attacker to disclose information over a network. Affected product: Microsoft Excel; root cause: out-of-bounds read. Impact: information disclosure. CVSS: Network vector, high confidentiality impact, base score ...

CVE-2026-81399

CVE-2026-81399 is a buffer over-read vulnerability in Microsoft Office Excel that allows a local attacker to disclose information . The CVSS 3.1 score is 5.5 (MEDIUM) with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, meaning exploitation requires user interaction (e.g., opening a crafted file)...

CVE-2026-81401

CVE-2026-81401 is a type confusion vulnerability in Microsoft Office Excel that allows an unauthorized attacker to disclose information locally . The flaw stems from access of a resource using an incompatible type. The assigned CVSS 3.1 score is 5.5 (Medium) with a local attack vector, low comple...

CVE-2008-0116

CVE-2008-0116 is a remote-code-execution vulnerability in Microsoft Excel’s handling of rich text values during memory loading. The issue affects Excel 2000 SP3–2003 SP2, Excel Viewer 2003, the Compatibility Pack, and Excel for Mac (2004/2008). A malformed rich-text tag in a crafted Excel file co...

CVE-2010-3233

CVE-2010-3233 is part of a family of Excel vulnerabilities addressed by MS10-080. The public records describe multiple remote code execution flaws in Microsoft Office Excel/Office components (notably Lotus 1-2-3 and various Excel file formats) that could be triggered by opening specially crafted ...

CVE-2011-1278

CVE-2011-1278 affects Microsoft Excel 2002 SP3 and Office 2004 for Mac. The issue arises when parsing Excel record information, where input validation failures can lead to remote code execution or memory corruption via a crafted spreadsheet (Excel WriteAV vulnerability). The vulnerability is tied...

CVE-2025-54896

CVE-2025-54896 is a Use-After-Free vulnerability in Microsoft Office Excel that can enable local code execution. Affected component: Microsoft Excel (Office). Root cause: use-after-free condition in Excel leading to arbitrary code execution. Impact: remote code execution with high severity (per C...

CVE-2000-0419

The Office 2000 UA ActiveX control is described as wrongly marked “safe for scripting.” This vulnerability allows an intruder to script interactions through the control’s Show Me feature, potentially disabling macro warnings and enabling arbitrary actions within Office applications (e.g., launchi...

CVE-2006-1301

Microsoft Excel versions 2000 through 2004 are vulnerable to remote code execution due to a memory corruption flaw. The issue is caused by insufficient checks while parsing SELECTION records in .xls files. An attacker can exploit this by enticing a user to open a specially crafted spreadsheet, po...

CVE-2011-1279

The CVE-2011-1279 issue affects Microsoft Excel 2002 SP3, 2003 SP3, Office 2004/2008 for Mac, and Open XML File Format Converter for Mac. Root cause is improper validation/parsing of record information in Excel files, leading to memory corruption that enables remote code execution or denial of se...

CVE-2013-3159

CVE-2013-3159 stems from an XML External Entity (XXE) issue affecting Microsoft Excel 2003 SP3, 2007 SP3, and 2010 SP1/SP2, as well as Excel Viewer and Microsoft Office Compatibility Pack SP3. The vulnerability enables a remote attacker to read arbitrary files by delivering an XML document contai...

CVE-2016-7213

CVE-2016-7213 is tied to memory corruption in Microsoft Office components used by Excel across Windows and macOS platforms (Excel 2007/2010/2013/2016, Office for Mac 2011/2016, and Office Compatibility Pack). The root cause is improper handling of objects in memory, enabling remote attackers to e...

CVE-2025-49711

Microsoft Office Excel is affected by CVE-2025-49711 (Use-after-free in Excel) enabling local code execution. The vulnerability is documented across multiple sources, with the Microsoft Excel RCE identified as the root cause and trusted updates released. Affected products include Microsoft Excel ...

CVE-2025-53735

CVE-2025-53735 is a Microsoft Excel remote code execution vulnerability caused by a use-after-free condition in Excel. The issue allows an attacker to run arbitrary code locally when a user opens a specially crafted Excel file. Microsoft has released security updates to address this vulnerability...

CVE-2025-62563

CVE-2025-62563 is a Use-After-Free vulnerability in Microsoft Excel that allows local code execution. The issue affects Microsoft Excel/Office components and is described in multiple feeds (CVE entry, EUVD/NCSC/CIRCL sightings, and vendor advisories). The core flaw is use-after-free in Excel, ena...

CVE-2026-32189

CVE-2026-32189 affects Microsoft Excel. The vulnerability allows Remote Code Execution with a Local attack vector, requiring user interaction, and does not require privileges. The base CVSSv3.1 rating is 7.8 (HIGH) with impact on confidentiality, integrity, and availability. Root cause details ar...

CVE-2026-50678

CVE-2026-50678: A heap-based buffer overflow in Microsoft Excel (Office) allows local information disclosure. CVSS v3.1 base score 6.6 (Medium): AV:L, AC:L, PR:N, UI:R, S:U, C:L, I:L, A:H. No exploit details are provided in the accompanying documents; remediation status/patch info not specified.

CVE-2002-0618

CVE-2002-0618 affects Microsoft Excel 2000/2002 on Windows. The vulnerability stems from a flaw in the Macro Security Model that fails to detect HTML scripting within an Excel workbook containing an XSL stylesheet, allowing remote attackers to execute code in the Local Computer zone. Exploitation...

CVE-2006-1304

Microsoft Excel 2000–2003 contains a remote code execution vulnerability in the COLINFO record processing that can be triggered by a specially crafted .xls file. The underlying issue is a buffer overflow during a data filling operation, which could allow an attacker to execute arbitrary code with...

CVE-2010-0824

CVE-2010-0824 is one of multiple Excel memory‑corruption vulnerabilities in the MS10-038 family. It affects Microsoft Office Excel components when parsing the Excel file format, specifically via a malformed WOPT (0x80B) record that can enable remote code execution. Affected products include Excel...

CVE-2025-60727

CVE-2025-60727 affects Microsoft Excel (Office) with an out-of-bounds read in Excel that enables local code execution. The vulnerability is documented across multiple feeds (MSRC/MSKB entries, CNVD, EUVD) and is associated with Excel-related exploitation in November 2025 advisories. The available...

CVE-2026-26108

CVE-2026-26108 is a Microsoft Excel heap-based buffer overflow vulnerability that allows an attacker to execute code locally. Multiple connected sources corroborate Excel as the affected component, with the underlying issue described as a heap-based overflow leading to remote code execution in Ex...

CVE-2006-0028

CVE-2006-0028 is a Microsoft Excel remote code execution vulnerability tied to malformed BIFF parsing format files that can corrupt memory and allow arbitrary code execution. Affected products include Excel 2000, 2002, and 2003 (and Office 2000 SP3 and related packages). Exploitation requires a u...

CVE-2008-0112

CVE-2008-0112 (Excel File Import Vulnerability) describes a remote code execution in Microsoft Excel 2000 SP3 and Office for Mac 2004/2008 triggered by importing a specially crafted SYLK (.slk) file. The underlying issue is improper validation/handling of SYLK data during import, allowing an atta...

CVE-2011-1990

CVE-2011-1990 affects Microsoft Excel 2007 SP2, Excel in Office 2007 SP2, Excel Viewer SP2, Office Compatibility Pack SP2, and Excel Services on Office SharePoint Server 2007 SP2. The vulnerability arises from improper validation of the sign of an unspecified array index, allowing remote code exe...

CVE-2026-55031

CVE-2026-55031 is a Microsoft Office Excel vulnerability described as an out-of-bounds read that allows a locally authenticated attacker to execute code. The CVSS‑3.1 vector is Local, with Low attack complexity, and no privileges required, but user interaction is required and the impact is High f...

CVE-2026-55039

CVE-2026-55039 affects Microsoft Excel (Office suite). The vulnerability is described as an integer underflow/wraparound in Excel that can allow an attacker to execute arbitrary code locally. According to the CVE record and linked advisories, the impact is remote code execution on the target mach...

CVE-2026-55131

Root cause: a heap-based buffer overflow in Microsoft Office Excel (part of Microsoft Office) allows an attacker to execute code locally. Affected: Excel; vulnerability appears to enable local code execution upon exploitation of the overflow. CVSSv3.1 metrics indicate Local access, No privileges ...

CVE-2001-0718

The CVE-2001-0718 issue affects Microsoft Excel and PowerPoint (across Windows and Macintosh releases up to 2002). Affected components are the macro handling/data stream processing; attackers can bypass macro restrictions by modifying the document data stream, enabling arbitrary code execution wh...

CVE-2002-0615

CVE-2002-0615 affects Windows Media Player 7.1 (and related Media Player versions) where the Windows Media Active Playlist stores data in a well-known local file path, enabling HTML script execution in the Local Computer zone. Connected documentation also references MS02-032 (patch 320920) that f...

CVE-2006-1302

CVE-2006-1302 describes a memory corruption vulnerability in Microsoft Excel 2000–2003 (and related 2000–2004 variants) triggered by parsing certain fields in a SELECTION record within a .xls file, leading to possible arbitrary code execution when a user opens a crafted Excel file. The issue is a...

CVE-2006-1308

CVE-2006-1308 is a remote code execution vulnerability in Microsoft Excel (2000–2004) caused by processing a malformed FNGROUPCOUNT value in an Excel file. The issue can be triggered when opening a specially crafted .xls, potentially allowing an attacker to execute arbitrary code in the security ...

CVE-2014-6361

Microsoft Excel vulnerabilities CVE-2014-6361/6360-6361 affect Excel 2007 SP3, 2010 SP2, 2013 Gold/SP1, 2013 RT/RT SP1 and Office Compatibility Pack. The issue is a memory-corruption remote-code-execution flaw triggered by parsing crafted Office documents, enabling arbitrary code execution when a...

CVE-2025-54903

CVE-2025-54903 is a Microsoft Excel remote code execution vulnerability described as a use-after-free in Excel that could allow an attacker to execute code locally. The CVSS 3.1 metrics indicate a local, low-attack-complexity, no privileges required, with user interaction required, and high impac...

CVE-2026-81398

CVE-2026-81398 is a heap-based buffer overflow in Microsoft Office Excel that allows an unauthorized attacker to execute code locally. The CVSS v3.1 score is 7.8 (HIGH) with a vector of AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning a local attack with low complexity requires user interaction (e.g....

CVE-2000-0765

CVE-2000-0765 describes a buffer overflow in the HTML interpreter of Microsoft Office 2000 . An attacker could trigger the overflow via a long embedded object tag in HTML, allowing execution of arbitrary commands. The sources provide the vulnerability description but do not specify affected versi...

CVE-2007-3490

Microsoft Excel 2003 SP2 contains a memory corruption vulnerability in the way it parses hostile XLS sheet names (as demonstrated by 2670.xls). A remote attacker could exploit this by persuading a user to open a crafted XLS file, potentially allowing arbitrary code execution in the security conte...