CVE-2017-11854

CVE-2017-11854 affects Microsoft Word 2007 SP3, Word 2010 SP2, Office 2010 SP2, and Office Compatibility Pack SP3. The root cause is improper handling of memory-resident objects, enabling arbitrary code execution in the context of the current user when a specially crafted file is opened. In the d...

CVE-2019-1035

Microsoft Word remote code execution (CVE-2019-1035) arises from improper handling of in-memory objects, enabling a specially crafted Word file to execute actions in the caller’s security context. Exploitation requires the user to open the crafted file, with delivery vectors including email attac...

CVE-2020-1229

CVE-2020-1229 is a security feature bypass in Microsoft Outlook/Office where security settings aren’t enforced, allowing an attacker to craft an image that, when opened, could cause the system to load remote images and reveal the target’s IP address. Exploitation requires user interaction (openin...

CVE-2021-1716

CVE-2021-1716 is a Microsoft Word Remote Code Execution vulnerability. The initial entry confirms a Word-related RCE with CVSS v3.1 base score 7.8 (HIGH) and local attack vector, with user interaction required. Connected sources (Nessus/Office/SharePoint plugin data) reference CVE-2021-1716 as pa...

CVE-2023-36568

CVE-2023-36568 is a Microsoft Office Click-To-Run elevation-of-privilege vulnerability. The CVE entry lists a CVSS v3.1 base score of 7.0 (HIGH) with Local attack vector, high impact to confidentiality, integrity and availability, and requires low privileges with no user interaction; the scope is...

CVE-2025-21395

CVE-2025-21395 is a Microsoft Access remote code execution vulnerability. Documents indicate it affects Microsoft Access/Office components and is exploitable by convincing a target to download and run a malicious file via social engineering. CVSSv3.1 data shows Local attack vector, Privileges Req...

CVE-2025-27745

CVE-2025-27745 is a Microsoft Office remote code execution vulnerability described as a use-after-free in Office that enables local code execution. Public details in connected sources confirm the affected software is Microsoft Office (various components) with the root cause tied to use-after-free...

CVE-2006-0002

CVE-2006-0002 is a TNEF decoding vulnerability in Microsoft Outlook (2000–2003) and Microsoft Exchange Server (5.0 SP2, 5.5 SP4, 2000 SP3) where processing a crafted TNEF MIME attachment can lead to remote code execution. Root cause described as improper handling/validation of TNEF data, enabling...

CVE-2020-0991

CVE-2020-0991 is a Microsoft Office remote code execution vulnerability caused by improper handling of objects in memory. The issue affects Office components (Word, Excel, PowerPoint, Visio, Publisher and related engines) and can allow an attacker to execute arbitrary code in the context of the c...

CVE-2023-21738

CVE-2023-21738 is a Microsoft Office Visio remote code execution vulnerability. Connected sources confirm affected components are within Microsoft Office Visio (Visio-related objects/flows) and indicate the underlying risk is remote code execution with high impact (C/H/I/A). Exploitation is repor...

CVE-2016-3209

CVE-2016-3209 affects Microsoft GDI+ across Windows Vista/7/8.1/Server 2008-2012 and various Office/.NET components, enabling information disclosure by bypassing ASLR through unspecified vectors. Connected sources confirm exploitation activity (e.g., Exploit DB). Public references note MS16-120 a...

CVE-2020-0892

CVE-2020-0892 is a Microsoft Word remote code execution vulnerability. The linked documents confirm Word is vulnerable when it fails to properly handle objects in memory, allowing a crafted file to run code in the current user’s context. The issue is tied to multiple Word-related CVEs and is disc...

CVE-2020-1218

CVE-2020-1218 – Microsoft Word Remote Code Execution : A vulnerability in Word where memory handling of in-file objects can be corrupted by a specially crafted file. An attacker could exploit this via email or a compromised website by convincing a user to open the crafted Word document, executing...

CVE-2020-1224

CVE-2020-1224 describes an information-disclosure vulnerability in Microsoft Excel where memory contents could be improperly disclosed. The issue arises when Excel handles objects in memory, allowing an attacker to craft a document that, if opened by a user, could reveal memory contents and poten...

CVE-2025-27744

CVE-2025-27744 is an elevation-of-privilege vulnerability in Microsoft Office (Office components including Word/Excel/OneNote/SharePoint and related updates). The root cause is described as improper access control allowing an authorized local attacker to elevate privileges. Affected products span...

CVE-2016-3301

CVE-2016-3301 affects the Windows Graphics Component in the Windows font library, enabling remote code execution via a crafted embedded font. Affected products include Windows Vista SP2; Windows Server 2008 SP2/R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; W...

CVE-2018-0792

CVE-2018-0792 is a remote-code-execution vulnerability in Word 2016/Microsoft Office 2016, caused by unsafe handling of in-memory objects. Affected software includes Word 2016 (Office 2016). The vulnerability could allow an attacker to execute arbitrary code on a vulnerable host when a specially ...

CVE-2019-1331

CVE-2019-1331 is a Microsoft Excel remote code execution vulnerability caused by improper handling of in-memory objects. The Red Hat CVE entries and NVD description identify it as an Excel memory‑handling issue that enables RCE when exploited, with no further exploit details provided in the suppl...

CVE-2020-1582

CVE-2020-1582 is a Microsoft Access remote code execution vulnerability caused by improper handling of in-memory objects. An attacker could run arbitrary code in the caller’s context by convincing a user to open a specially crafted Access file; if the user has administrative rights, system takeov...

CVE-2021-28451

CVE-2021-28451 is a Microsoft Excel remote code execution vulnerability. Public documentation in the initial record shows CVSS v3.1 base score 7.8 (HIGH) with LOCAL, LOW-C, UI:R, CONSEQUENCES: HIGH for confidentiality, integrity, and availability. The connected Microsoft security advisories indic...

CVE-2022-38010

CVE-2022-38010 is a Microsoft Office Visio remote code execution vulnerability. Public listings and update guidance identify Visio 2013 (KB5002017) and Visio 2016 (KB5002016) as affected, with deployment differences: Visio 2013 updates apply to the MSI-based edition (SP1 required) and Visio 2016 ...

CVE-2022-41104

Technical details about CVE-2022-41104 are not publicly provided in the supplied documents. Monitor for updates from official advisories; current sources only confirm a security feature bypass in Microsoft Excel without specifics.

CVE-2022-41107

CVE-2022-41107 is a Microsoft Office Graphics Remote Code Execution vulnerability. The issue is tracked across multiple feeds as affecting Microsoft Office graphics functionality with high-impact potential. The primary vulnerability detail in the connected data is that Office Graphics can be expl...

CVE-2022-44692

CVE-2022-44692 is a Microsoft Office Graphics remote code execution vulnerability. The connected sources confirm a vulnerability in the Office Graphics component that could allow an attacker to execute arbitrary code on the target host, potentially compromising confidentiality, integrity, and ava...

CVE-2023-33149

CVE-2023-33149 is Microsoft Office Graphics Remote Code Execution affecting Office graphics handling across multiple Office versions (e.g., Office 2013 SP1, 2016, 2019, 365) per OpenVAS entries; root cause is not fully detailed in the documents, but several OpenVAS plugins reference this CVE alon...

CVE-2023-21741

CVE-2023-21741 affects Microsoft Office Visio. Description: Information disclosure vulnerability in Visio; attacker could obtain sensitive memory data and use it for further attacks. Reported metrics show CVSS 3.1 base score 7.1 (HIGH) with: Attack Vector NETWORK, Attack Complexity LOW, Privilege...

CVE-2023-33151

CVE-2023-33151 is a Microsoft Outlook spoofing vulnerability publicly tracked with CVE-2023-33151. Connected sources confirm exploitation status in KEV catalog entries and ties to Outlook spoofing and security feature bypass issues. Affected context includes Outlook versions tied to the July 2023...

CVE-2024-30104

CVE-2024-30104 is a Microsoft Office remote code execution vulnerability affecting Office components (notably Outlook) where exploitation relies on the user opening a malicious file. The public details describe a remote code execution risk with a user interaction requirement and, in related analy...

CVE-2025-27748

CVE-2025-27748 is a Microsoft Office remote code execution vulnerability caused by a use-after-free in Office components. The issue permits a local attacker to execute code on an affected host. Public details in the provided documents indicate this vulnerability is addressed via Microsoft's April...

CVE-2025-47167

Microsoft Office remote/local code execution vulnerability CVE-2025-47167 arises from an incompatible type (type confusion) when accessing resources, allowing an unauthenticated or authenticated attacker to execute code with the user’s context. Affected products span Office suite components (Word...

CVE-2009-2501

CVE-2009-2501 describes a heap-based buffer overflow in Microsoft GDI+ when processing PNG images, enabling remote code execution via crafted PNGs. Affected software/contexts include Internet Explorer 6 SP1 on Windows XP (SP2/SP3) and various Microsoft Office components and viewers that rely on G...

CVE-2016-0140

Summary: CVE-2016-0140 is a remote code execution memory corruption flaw in Microsoft Office components including Office 2007 SP3, Office 2010 SP2, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2. The issue arises from improper handling of objects in memory, a...

CVE-2021-28452

CVE-2021-28452 is a Microsoft Outlook memory corruption vulnerability described by the NVD and Microsoft MSRs as affecting Outlook components and addressed by security updates. Public docs in the provided set confirm: (1) the issue is a memory corruption vulnerability in Outlook (Microsoft Office...

CVE-2022-21988

Technical details for CVE-2022-21988 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2022-41106

CVE-2022-41106 is a Microsoft Excel Remote Code Execution vulnerability. Public details in connected docs describe Excel/Office components as affected and indicate that security updates exist. Remediation in public docs includes security updates: KB5002253 for Excel 2016 (and related Office insta...

CVE-2025-21387

CVE-2025-21387 is a Microsoft Excel remote code execution vulnerability tied to Office/Excel 2016. Public advisories and the Microsoft KB describe an Excel RCE issue that is fixed by the February 2025 Office 2016 security update KB5002684 (MSKB). The fix applies to MSI-based Office 2016 installat...

CVE-2020-17019

CVE-2020-17019 is a Microsoft Excel Remote Code Execution vulnerability in Microsoft Office. The CVSS v3.1 base metrics indicate a HIGH severity with Local attack vector, Privileges None, UI Required, and Impact to Confidentiality, Integrity, and Availability at HIGH. Documents confirm affected s...

CVE-2020-17126

CVE-2020-17126 is identified as a Microsoft Excel Information Disclosure Vulnerability. The primary entry (NVD/NIST) classifies it under an information disclosure issue with a CVSS v3.1 base score of 5.5 (local access, low privileges, high confidentiality impact; no integrity/availability impact ...

CVE-2021-40479

CVE-2021-40479 is a Microsoft Excel remote code execution vulnerability. The linked documents confirm it affects Excel components and was addressed in the October 12, 2021 security updates (e.g., KB5001982 for Office 2016/2013 and related Office updates). The available sources indicate multiple E...

CVE-2021-42293

The CVE-2021-42293 entry concerns a elevation of privilege flaw in Microsoft's Jet Red Database Engine and Access Connectivity Engine. Connected sources confirm affected components are the Jet Red database engine and the Access connectivity engine used by Office products (notably Office 2013/2016...

CVE-2022-22004

CVE-2022-22004 is a Microsoft Office ClickToRun remote code execution vulnerability. Affected software: Microsoft Office ClickToRun components within Office products. Root cause and impact are described across connected sources: exploitation leads to remote code execution with a high impact profi...

CVE-2022-41063

CVE-2022-41063 is a Microsoft Excel remote code execution vulnerability. The connected documents confirm Excel as the affected product and cite a remote code execution issue, with the NVD entry providing a CVSSv3.1 score of 7.8 (HIGH) and a Local attack vector with User Interaction required. The ...

CVE-2009-0562

CVE-2009-0562 describes a heap memory corruption in the Office Web Components ActiveX control (OWC10.DataSourceControl) used by Office XP/2003 Web Components and related components. The vulnerability could allow remote code execution when a user loads a malicious page that loads/unloads the contr...

CVE-2017-0014

Public technical details for CVE-2017-0014 are not present in the provided connected documents. The records describe affected products and cross-reference other CVEs, but no concrete exploit vectors, impact specifics, or remediation are disclosed here. Monitor for updates.

CVE-2018-8573

CVE-2018-8573 is a remote code execution vulnerability in Microsoft Word/Office products caused by improper handling of objects in memory. The vulnerability could allow an attacker to execute arbitrary code in the security context of the current user when a specially crafted file is opened. Multi...

CVE-2020-17020

CVE-2020-17020: Microsoft Word Security Feature Bypass vulnerability. Affects Word (e.g., Word 2016 era). Root cause not explicitly detailed in the provided docs. Local attack vector with low complexity; attacker could bypass security features without user interaction via a crafted file, with con...

CVE-2021-28456

CVE-2021-28456 is a Microsoft Excel information disclosure vulnerability. The CVE is linked to Excel components and is reported in multiple sources as part of a family of vulnerabilities affecting Excel and Office products (e.g., CVE-2021-28449, CVE-2021-28451, CVE-2021-28454). The connected docu...

CVE-2017-0288

CVE-2017-0288 is a Windows graphics information disclosure vulnerability in the Graphics Device Interface (GDI). The Windows GDI component improperly discloses memory contents, enabling information disclosure on affected systems. Connected advisories confirm this issue affecting multiple Windows ...

CVE-2017-8528

CVE-2017-8528 concerns a remote code execution vulnerability in Microsoft Windows Uniscribe (usp10.dll) where объектs in memory are mishandled. Affected platforms span Windows 7/8.1/10 and several Server SKUs with Office 2007/2010. Exploitation is possible via crafted documents or web content, pe...

CVE-2025-21361

CVE-2025-21361 affects Microsoft Outlook for Mac (and related Outlook/Office deployments). Connected documents indicate a remote code execution vulnerability in Microsoft Outlook for Mac, with impact described as arbitrary code execution and high impact on confidentiality, integrity, and availabi...