CVE-2020-0852

CVE-2020-0852 is a Microsoft Word Remote Code Execution vulnerability. The issue arises when Word fails to properly handle objects in memory, allowing a specially crafted file to execute code in the caller’s security context. The exploitation vector involves a user opening a malicious file; no ne...

CVE-2020-17119

CVE-2020-17119 is an Outlook information-disclosure vulnerability that is referenced across multiple feeds as part of the Microsoft Office updates for macOS (December 2020). The initial entry identifies Outlook Information Disclosure as the issue, while connected documents confirm the CVE is bund...

CVE-2021-28454

CVE-2021-28454 = Microsoft Excel Remote Code Execution Vulnerability in Office suites. Root cause described as a vulnerability in Excel that allows code execution with the privileges of the logged-in user (UI: REQUIRED, vector: LOCAL). Affected products include various Office versions that includ...

CVE-2021-40472

CVE-2021-40472 is an information-disclosure vulnerability in Microsoft Excel. The NVD entry lists CVSS v3.1 impact: confidentiality HIGH with LOCAL attack vector, low complexity, and no user interaction (base score 5.5). CVSS v2.0 reflects a lower base score (2.1). The connected documents confirm...

CVE-2025-29791

CVE-2025-29791 is a Microsoft Excel/Office remote code execution vulnerability caused by type confusion in Office components. It allows a local attacker to execute code with high impact; attack vector is local and user interaction is required (per CVSS 3.1: AV=L, AC=L, PR=None, UI=Required, C/H/I...

CVE-2025-47162

CVE-2025-47162 (Microsoft Office RCE) : A heap-based buffer overflow in Microsoft Office enables an attacker to execute arbitrary code locally. Public details list this as a local-exploitation vulnerability with no user interaction required (per the CVE description and Microsoft’s MSRC page). Aff...

CVE-2017-0254

CVE-2017-0254 concerns a remote code execution in Microsoft Office applications (Word, PowerPoint, etc.) and related components when the software fails to properly handle objects in memory. The vulnerability affects multiple Office products across Windows and macOS (e.g., Word 2007, Office 2010 S...

CVE-2020-0961

Summary (supported by provided documents): CVE-2020-0961 is a remote code execution vulnerability in the Microsoft Office Access Connectivity Engine that occurs when the engine improperly handles memory objects. The Nessus plugin for Office C2R April 2020 explicitly lists CVE-2020-0961 among mult...

CVE-2020-1495

CVE-2020-1495 (Microsoft Excel) : A remote code execution via memory corruption in Excel occurs when the application fails to correctly handle objects in memory. An attacker who can lure a user to open a specially crafted Excel file (e.g., via email or a website) could execute arbitrary code in t...

CVE-2022-41060

CVE-2022-41060 is a Microsoft Word information disclosure vulnerability. The connected documents reference Word/Office components affected by the November 2022 updates and Office Web Apps Server updates (e.g., KB5002261, KB5002276) addressing Word information disclosure and related vulnerabilitie...

CVE-2025-47175

Microsoft PowerPoint CVE-2025-47175 is a Use-After-Free in PowerPoint that can lead to local code execution when a user opens a crafted PPTX file. Exploit details in connected sources indicate a local attacker must persuade a victim to open the file (PoC guidance exists for PowerPoint 2019 / Offi...

CVE-2020-1483

CVE-2020-1483 is a Microsoft Outlook remote code execution vulnerability caused by improper handling of in‑memory objects. An attacker could run code with the current user’s privileges; if the user has admin rights, the attacker could take full control of the system. Exploitation requires a user ...

CVE-2025-21345

Microsoft Office Visio contains a remote code execution vulnerability (CVE-2025-21345) tied to a Use-After-Free style issue in Visio components. The CVE affects Microsoft Visio when a user opens a specially crafted Visio file, potentially allowing an attacker to execute arbitrary code on the affe...

CVE-2025-21402

CVE-2025-21402 is a Microsoft Office OneNote remote code execution vulnerability. The NVD entry notes a HIGH risk with CVSS 3.1: Local attack vector, low attack complexity, user interaction required, and impact to confidentiality, integrity, and availability. Multiple connected sources corroborat...

CVE-2025-27752

CVE-2025-27752 is a heap-based buffer overflow in Microsoft Excel that allows local code execution. The vulnerability is associated with Microsoft Office Excel and is addressed by the April 2025 Office security updates KB5002700 and KB5002623 (Office 2016 MSI). These updates resolve remote code e...

CVE-2015-2464

CVE-2015-2463 and CVE-2015-2464 describe a TrueType font parsing vulnerability that allows remote code execution. Affected products include Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8/8.1, Windows Server 2012 Gold/R2, Windows RT 8.1, Office 2007 SP3 and 2010 SP2, L...

CVE-2018-0804

The CVE-2018-0804 entry concerns a remote code execution in the Equation Editor of Microsoft Office 2003–2016 due to the way in-memory objects are handled. Affected software includes Office 2003, 2007, 2010, 2013, and 2016; the root cause is improper handling of objects in memory within the Equat...

CVE-2020-0980

CVE-2020-0980 is a Microsoft Word remote code execution vulnerability caused by improper handling of in-memory objects. It affects Word/Office when parsing crafted files; the impact is potential code execution in the current user context. In public docs, the vulnerability is addressed by the Offi...

CVE-2021-41368

CVE-2021-41368 is a Microsoft Office Access remote code execution vulnerability. Connected sources confirm it affects Office products and was addressed by security updates KB5002032 (Office 2016/ MSI-based installs) and KB5002038 (Office 2013 / MSI-based installs). The Office updates resolve the ...

CVE-2024-38171

CVE-2024-38171 is Microsoft PowerPoint Remote Code Execution vulnerability. The CVE entry indicates a PowerPoint RCE with a CVSSv3.1 base score of 7.8 (HIGH) and local attack vector requiring user interaction. Connected sources corroborate Windows/Office updates addressing CVE-2024-38171: a Augus...

CVE-2017-0060

The CVE-2017-0060/0062 issue affects the Graphics Device Interface (GDI) in multiple Windows releases (Vista through Windows 10 variants listed in the initial entry). The vulnerability enables a remote attacker to obtain sensitive information from process memory by visiting a crafted web site, i....

CVE-2020-1498

CVE-2020-1498 is a remote code execution vulnerability in Microsoft Excel caused by improper handling of objects in memory. An attacker who can lure a user to open a specially crafted Excel file could execute arbitrary code in the user’s context. If the user has administrative rights, the attacke...

CVE-2024-43465

CVE-2024-43465 is an Elevation of Privilege vulnerability affecting Microsoft Excel components in Office products. The connected documents indicate the issue is addressed by official security updates (e.g., KB5002601 for Office Online Server and KB5002605 for Excel 2016) released September 10, 20...

CVE-2012-0143

CVE-2012-0143 affects Microsoft Excel 2003 SP3 and Office 2008 for Mac, where memory corruption during file opening can allow remote code execution via a crafted spreadsheet. The vulnerability is part of a family including CVE-2012-0141/0142/0143/0143/0184 (and related) affecting Office component...

CVE-2012-0177

CVE-2012-0177 affects the Office Works File Converter in Microsoft Office 2007 SP2, Works 9, and Works 6–9 File Converter. The vulnerability is a heap-based buffer overflow when parsing .wps (Works) files, enabling remote code execution. The attacker could trigger this without user interaction, p...

CVE-2025-21186

CVE-2025-21186 is a Microsoft Access remote code execution vulnerability. Public details in connected sources indicate a heap-based buffer overflow in Microsoft Access (notably Access 2016, 32/64‑bit) that could allow arbitrary code execution when a user opens a crafted file or input. Exploitatio...

CVE-2025-27751

CVE-2025-27751 is a Microsoft Excel remote code execution vulnerability described as a use-after-free in Excel, enabling an attacker to run code locally. Public materials in the connected set confirm an in-Excel object lifecycle issue is exploited via crafted DOCX payloads to achieve code executi...

CVE-2017-0289

CVE-2017-0289 is a Windows Graphics Information Disclosure vulnerability affecting a broad set of Windows client/server releases (e.g., Windows 7/8.1/10, Windows Server 2008-2016) where the Windows GDI/Graphics components improperly disclose memory contents. The issue is linked to memory disclosu...

CVE-2020-1342

CVE-2020-1342 is an information-disclosure vulnerability in Microsoft Office (notably Word/Office components) caused by reading out of bound memory due to an uninitialized variable. The detail explicitly states memory contents could be disclosed when a vulnerable file is opened in affected Office...

CVE-2021-40473

CVE-2021-40473 corresponds to an Excel remote code execution vulnerability. Connected sources confirm Microsoft Office/Excel as the affected product and that updates released in October 2021 (e.g., KB5001982 for Office 2016/2013) address this and related CVEs by applying security updates to Excel...

CVE-2022-41103

CVE-2022-41103 is Microsoft Word Information Disclosure Vulnerability. Connected sources indicate it is referenced alongside Word/Office and SharePoint update bundles (e.g., Word C2R and SharePoint November 2022 patches). The vulnerability is described as information disclosure; no explicit root-...

CVE-2024-30101

Summary: CVE-2024-30101 is a Microsoft Office remote code execution vulnerability affecting Office/Outlook components. Details from sources: the issue can be triggered via the Outlook vector (Preview Pane) with the attacker needing the user to perform specific actions, and it relies on a race con...

CVE-2025-30377

CVE-2025-30377 is a Use-After-Free vulnerability in Microsoft Office that can lead to local code execution. Affected products span Microsoft Office components (Office 2016/2019/2021/365 families and related Office applications) with the root cause described as a use-after-free condition allowing ...

CVE-2009-2501

CVE-2009-2501 describes a heap-based buffer overflow in Microsoft GDI+ when processing PNG images, enabling remote code execution via crafted PNGs. Affected software/contexts include Internet Explorer 6 SP1 on Windows XP (SP2/SP3) and various Microsoft Office components and viewers that rely on G...

CVE-2016-3304

CVE-2016-3304 is the Windows Graphics Component remote code‑execution vulnerability where the Windows font library improperly handles crafted embedded fonts, affecting Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, Windows 7 SP1, Office 2007 SP3/2010 SP2, Word Viewer, Skype for Business 2016,...

CVE-2018-8432

CVE-2018-8432 is a remote code execution in Microsoft Graphics Components. It affects Windows and Office components (e.g., Office, Word Viewer, Excel Viewer, PowerPoint Viewer) across multiple Windows and Office versions; the underlying issue is how Graphics Components handle objects in memory. E...

CVE-2019-0953

CVE-2019-0953 is a remote-code-execution vulnerability in Microsoft Word caused by improper handling of objects in memory. The issue affects Word components across Office clients (notably Word 2016/2019) and can be triggered by a specially crafted file, enabling code execution in the caller’s sec...

CVE-2019-1264

Summary (CVE-2019-1264) : A security feature bypass in Microsoft Office arises from improper handling of input within Office components. Connected sources confirm this as a Microsoft Office input-handling vulnerability that can allow an attacker to execute arbitrary commands when a user opens a s...

CVE-2011-1273

Microsoft Excel (Windows: 2002/2003/2007/2010; Mac: 2004/2008/2011; Open XML Converter for Mac; Excel Viewer; Office Compatibility Pack) is affected by CVE-2011-1273 due to improper validation/parsing of Excel records. Multiple advisories attribute the issue to parsing errors (record-type handlin...

CVE-2013-1325

CVE-2013-1325 is a heap-based buffer overflow in Microsoft Office 2003 SP3 and Office 2007 SP3 triggered by parsing WordPerfect (.wpd) documents, allowing remote code execution. Affected products parse WPD files and fail due to the underlying heap overflow, enabling arbitrary code execution when ...

CVE-2019-1148

CVE-2019-1148 affects the Microsoft Windows Graphics Component, where memory handling flaws can disclose information. The vulnerability requires the attacker to log on and run a crafted application, with potential information disclosure as the impact. Microsoft addresses it via a patch that fixes...

CVE-2020-1193

CVE-2020-1193 is a remote code execution vulnerability in Microsoft Excel where improper handling of in‑memory objects could allow code to run in the user’s context after opening a specially crafted Excel file. The description states exploitation requires the user to open a crafted file; the fix ...

CVE-2020-1229

CVE-2020-1229 is a security feature bypass in Microsoft Outlook/Office where security settings aren’t enforced, allowing an attacker to craft an image that, when opened, could cause the system to load remote images and reveal the target’s IP address. Exploitation requires user interaction (openin...

CVE-2020-1503

CVE-2020-1503 is an information-disclosure vulnerability in Microsoft Word where memory contents can be disclosed through a crafted Word document. The root cause is improper handling of in‑memory objects, enabling disclosure of memory contents when a user opens a malicious document. Exploitation ...

CVE-2023-21735

CVE-2023-21735 is a Microsoft Office remote code execution vulnerability described across multiple sources as affecting Microsoft Office products. Affected products include various Office suites and components (Office LTSC 2021/2019, Office for Mac, SharePoint/Visio components, and related Office...

CVE-2019-1464

CVE-2019-1464 is an information disclosure vulnerability in Microsoft Excel where memory contents can be improperly disclosed. The Red Hat entry and Nessus/OpenVAS advisories corroborate that Excel (Office) memory handling flaws enable exposure of user data. The concrete impact stated is informat...

CVE-2021-1711

CVE-2021-1711 is a Microsoft Office Remote Code Execution vulnerability. Connected sources confirm the issue affects Office products and can be triggered by opening a specially crafted Office file, leading to code execution. Public details reference related security updates (Office January 2021 p...

CVE-2013-3854

CVE-2013-3854 affects Microsoft Office 2007 SP3 and Word 2007 SP3. The vulnerability is described as memory corruption in Word that can be triggered by a crafted Office document, enabling remote code execution or, per the description, a denial of service. The CVSSv2 base score is 9.3 (HIGH) with ...

CVE-2017-11854

CVE-2017-11854 affects Microsoft Word 2007 SP3, Word 2010 SP2, Office 2010 SP2, and Office Compatibility Pack SP3. The root cause is improper handling of memory-resident objects, enabling arbitrary code execution in the context of the current user when a specially crafted file is opened. In the d...

CVE-2020-0991

CVE-2020-0991 is a Microsoft Office remote code execution vulnerability caused by improper handling of objects in memory. The issue affects Office components (Word, Excel, PowerPoint, Visio, Publisher and related engines) and can allow an attacker to execute arbitrary code in the context of the c...