CVE-2021-28456

CVE-2021-28456 is a Microsoft Excel information disclosure vulnerability. The CVE is linked to Excel components and is reported in multiple sources as part of a family of vulnerabilities affecting Excel and Office products (e.g., CVE-2021-28449, CVE-2021-28451, CVE-2021-28454). The connected docu...

CVE-2021-43875

CVE-2021-43875 targets Microsoft Office Graphics, causing a Remote Code Execution vulnerability. The CVE is classed as HIGH severity (CVSS v3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with a local attack vector and required user interaction. Affected products include Office Graphics components acro...

CVE-2025-21361

CVE-2025-21361 affects Microsoft Outlook for Mac (and related Outlook/Office deployments). Connected documents indicate a remote code execution vulnerability in Microsoft Outlook for Mac, with impact described as arbitrary code execution and high impact on confidentiality, integrity, and availabi...

CVE-2018-8574

CVE-2018-8574 is a remote code execution flaw in Microsoft Excel/Office caused by how the program handles objects in memory. An attacker could exploit this by opening a specially crafted file, executing arbitrary code under the current user’s context (potentially with admin rights). Public-connec...

CVE-2019-0540

CVE-2019-0540 is a security feature bypass in Microsoft Office where URLs are not properly validated, enabling phishing-style credential theft when a victim opens a specially crafted file (Word component). The vulnerability is addressed by Microsoft Office security updates released in February 20...

CVE-2019-1400

CVE-2019-1400 is an information-disclosure vulnerability in Microsoft Access caused by improper handling of objects in memory. The NVD entry describes a memory handling flaw that allows partial confidentiality exposure when an attacker can trigger the condition locally. The CVSS‑3.1 vector is AV:...

CVE-2020-1449

CVE-2020-1449 is a remote code execution vulnerability in Microsoft Project caused by failing to check the source markup of a file. Public records show affected products include at least Project 2010, 2013, and 2016 variants, with the CVSSv3 base score variably cited (NVD lists 7.8 MED-HIGH; some...

CVE-2025-21346

CVE-2025-21346 is a Microsoft Office security feature bypass vulnerability affecting Office products (including Word/Excel and other components) as part of the January 2025 updates. The issue is categorized as a bypass of security protections, enabling bypass of certain restrictions in Office. Mi...

CVE-2016-3313

CVE-2016-3313 is a memory corruption vulnerability in Microsoft Office products that allows remote code execution when a user opens a crafted Office file. The CVE description lists affected software as Office 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016, plus Word 2016 for Mac and Word Vie...

CVE-2022-41105

CVE-2022-41105 is Microsoft Excel information-disclosure vulnerability. The issue (CVSSv3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) can reveal sensitive data to an attacker with local access and user interaction. Connected sources confirm Excel/Office components affected and publicly available upda...

CVE-2023-33152

CVE-2023-33152 is a Microsoft Office ActiveX remote code execution vulnerability. Documents indicate an RCE via Office ActiveX controls, with affected Office versions including Office 2013 and Office 2016. Mitigations are security updates KB5002069 (Office 2013) and KB5002058 (Office 2016). The C...

CVE-2025-21366

CVE-2025-21366 is a Microsoft Access remote code execution vulnerability. Connected sources confirm an Access/Office component impact with a patch released in January 2025 (KB5002670) for Access 2016 (32- and 64-bit). Exploitation details in the provided documents indicate social‑engineering deli...

CVE-2019-1462

CVE-2019-1462 is a remote code execution vulnerability affecting Microsoft PowerPoint/Office where memory objects are mishandled. The Red Hat advisory reiterates the same remote code execution issue, and various Nessus/OpenVAS entries tie the vulnerability to PowerPoint versions across Windows/ma...

CVE-2020-0855

Summary of CVE-2020-0855 (Microsoft Word RCE) : The connected documents describe a remote code execution flaw in Microsoft Word related to improper handling of objects in memory. An attacker could craft a file that, when opened by a user, runs code in the security context of that user. Exploitati...

CVE-2020-1335

CVE-2020-1335 is a Microsoft Excel remote code execution vulnerability caused by improper handling of memory objects. An attacker could run arbitrary code in the user’s context, potentially taking full control if the user has admin rights. Exploitation requires the user to open a specially crafte...

CVE-2023-33162

CVE-2023-33162 is an information disclosure vulnerability in Microsoft Excel. Connected sources confirm a fix via the Office Online Server July 2023 security update KB5002421 (build 16.0.10400.20000) and related Excel updates (e.g., KB5002426 for Excel 2016). The CVE entry notes a local, informat...

CVE-2024-49142

CVE-2024-49142 is a Microsoft Access remote code execution vulnerability. Connected sources confirm a vulnerability in Microsoft Access that allows arbitrary code execution when a malicious file is opened or run, and Microsoft released a security update to address it (KB5002641 for Access 2016). ...

CVE-2025-21354

Microsoft Excel contains a Remote Code Execution vulnerability, CVE-2025-21354, affecting Excel/Office components. The CVE is confirmed across multiple feeds (MSRC updates, Nessus patch advisories, CNVD/CVE listings) as part of several January–February 2025 Office updates. The root cause details ...

CVE-2025-47164

CVE-2025-47164 is a Microsoft Office remote code execution vulnerability described as a use-after-free condition in Office components. The affected suite includes Word, Excel, PowerPoint, Outlook, and SharePoint Server (various Office 2016/2019/2021 and related platforms), with the root cause ide...

CVE-2025-53766

CVE-2025-53766 is a heap-based buffer overflow in Windows GDI+ that enables a remote attacker to execute code over a network. Public details describe the vulnerability as a memory overflow in GDI+ triggered by processing specially crafted metafiles, potentially allowing arbitrary code execution w...

CVE-2016-0012

CVE-2016-0012 affects Microsoft Office suite (2007–2016 and related components) and is described as a security feature/ASLR bypass vulnerability. Connected OpenVAS entries explicitly reference remote bypass vectors in Office components (PowerPoint, Visio, Word, Excel, VB runtime) and note exploit...

CVE-2017-0260

Technical details for CVE-2017-0260 are not provided in the connected documents. The initial entry notes an Office Remote Code Execution vulnerability, but there are no concrete product/version/impact/fix details here. Monitor official advisories for updates.

CVE-2019-0669

CVE-2019-0669 is an information-disclosure vulnerability in Microsoft Excel where memory contents can be disclosed when a crafted document is opened. The issue arises from Excel failing to properly isolate or protect memory contents during document processing, enabling an attacker to obtain data ...

CVE-2021-40480

CVE-2021-40480 – Microsoft Office Visio remote code execution vulnerability. Connected sources describe an RCE affecting Microsoft Office Visio and related Office products, with several advisories and ASPATCH updates listed as mitigations. The primary affected component is the Visio entry point f...

CVE-2022-44691

CVE-2022-44691 is a Microsoft Office OneNote Remote Code Execution vulnerability. Affected: OneNote (Office) components within Office/OneNote C2R. Cause: unspecified in initial doc, but linked sources identify a remote code execution flaw in OneNote. Impact: arbitrary code execution with high imp...

CVE-2024-38250

CVE-2024-38250 is a Windows Graphics Component elevation-of-privilege vulnerability. The CVE entry (Microsoft product area) indicates a local attacker with low privileges and no user interaction could obtain higher privileges (CVSS 7.8, High). Connected sources corroborate that Microsoft has issu...

CVE-2025-27750

CVE-2025-27750 is a real vulnerability affecting Microsoft Excel within Microsoft Office. The connected sources confirm a use-after-free condition in Excel that allows an attacker to execute arbitrary code locally. The CVSSv3.1 vector (LOCAL, Privileges NONE, User Interaction REQUIRED) yields a b...

CVE-2017-8533

CVE-2017-8533 is an information‑disclosure vulnerability in Windows graphics handling, specifically the Uniscribe/GDI path, where memory contents can be exposed. The issue affects multiple Windows editions listed in the CVE entry (e.g., Windows 7 SP1, 8.1, various Windows 10 versions, Windows Ser...

CVE-2019-1446

CVE-2019-1446 describes an information-disclosure vulnerability in Microsoft Excel/Office where memory contents may be exposed due to improper handling of memory objects. The issue is discussed in connected Nessus/OpenVAS entries tied to November 2019 Office/Excel security updates, indicating aff...

CVE-2020-1447

CVE-2020-1447 is a Microsoft Word remote code execution vulnerability tied to how Word handles objects in memory. Connected sources corroborate that it affects Word and can allow an attacker to run code in the context of the current user when a specially crafted file is opened or processed. The N...

CVE-2020-1502

CVE-2020-1502 is an information-disclosure vulnerability in Microsoft Word where memory contents can be exposed due to how Word handles objects in memory. An attacker could lure a user to open a specially crafted document, potentially revealing memory contents needed to compromise data. The explo...

CVE-2020-17062

CVE-2020-17062 affects the Microsoft Office Access Connectivity Engine and is a Remote Code Execution vulnerability. The linked documents describe an exploit path that would require local access with user interaction (CVSSv3.1: 7.8 HIGH; AV:L, UI:R, C/H, I/H, A/H). The vulnerability targets Offic...

CVE-2022-23252

CVE-2022-23252 is a Microsoft Office information-disclosure vulnerability. The public records identify an Office-wide information disclosure issue affecting Office components (Word/Excel/PowerPoint, etc.) with the root cause described as an information-disclosure flaw and a potential impact of ex...

CVE-2026-40361

CVE-2026-40361 is a Use-After-Free vulnerability in Microsoft Word that allows local code execution without user interaction. Affected product: Word (Office). Underlying issue: use-after-free in a Word component leading to arbitrary code execution. CVSS 3.1 base score 8.4 (HIGH) with local attack...

CVE-2018-8539

CVE-2018-8539 is a remote code execution vulnerability in Microsoft Word (affecting Word, Office, and SharePoint) caused by improper handling of objects in memory. The root cause is memory object handling defects that allow an attacker to trigger code execution in the security context of the curr...

CVE-2018-8577

CVE-2018-8577 affects Microsoft Excel (and related Office components). The vulnerability arises when Excel fails to properly handle objects in memory, enabling a remote code execution where an attacker could run arbitrary code in the context of the current user. CVSSv3 vector indicates a local at...

CVE-2019-0561

CVE-2019-0561 is an information-disclosure vulnerability in Microsoft Word/Office related to improper handling of Word fields, specifically via Word macro buttons. The issue allows reading arbitrary files from the targeted system. Multiple Nessus/OpenVAS entries and advisories group CVE-2019-0561...

CVE-2020-1581

CVE-2020-1581 is an elevation of privilege vulnerability in Microsoft Office Click-to-Run (C2R). The issue stems from how C2R components handle objects in memory, enabling an attacker who already has code execution rights to elevate privileges by running a specially crafted application. The offic...

CVE-2019-0671

CVE-2019-0671 affects the Microsoft Office Access Connectivity Engine. The vulnerability is a memory handling flaw that could allow remote code execution when a user opens a specially crafted file. The issue is addressed by Office security updates released in February 2019 for Office C2R; monitor...

CVE-2019-1034

CVE-2019-1034 affects Microsoft Word/Office where in-memory handling of objects can be exploited to run remote code after a user opens a crafted file. Exploitation relies on social/vector delivery (email or web), with the attacker gaining the same rights as the logged-on user. The vulnerability i...

CVE-2020-1338

Microsoft Word Remote Code Execution (CVE-2020-1338): A vulnerability exists where Word mishandles in-memory objects, enabling an attacker to execute arbitrary code via a specially crafted Word file. Exploitation requires the current user to open the crafted file (e.g., via email or a compromised...

CVE-2020-1594

CVE-2020-1594 is a remote-code-execution vulnerability in Microsoft Excel caused by improper handling of in-memory objects. Exploitation requires a user to open a specially crafted Excel file; code could run with the current user’s privileges, and if that user has admin rights, full control of th...

CVE-2021-40481

CVE-2021-40481 is a vulnerability described as a remote code execution issue in Microsoft Office Visio . Public sources indicate affected products include Office Visio-related components within Office suites and Visio-related installations, with the CVSS3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H imp...

CVE-2022-44695

Technical details about CVE-2022-44695 are not publicly provided in the supplied connected documents. Available items reference the CVE and notes about Visio remote code execution and December 2022 updates, but do not specify affected versions, root cause, or fixes.

CVE-2025-26687

CVE-2025-26687 is a use-after-free in Windows Win32K - GRFX that enables a network-based privilege escalation. The affected component is the Win32K GRFX graphics subsystem; the underlying issue is a use-after-free in that path, leading to total impact (CVE-2025-26687 shows a base score of 7.5/10 ...

CVE-2025-27749

CVE-2025-27749 is a Microsoft Office remote code execution vulnerability based on a use-after-free in Office components. The impact is local code execution with high severity (CVSS v3.1: 7.8, LOCAL, user interaction required). Microsoft and MSRC guidance indicate updates exist: security updates f...

CVE-2020-1445

CVE-2020-1445 is an information disclosure vulnerability in Microsoft Office (notably Word) related to how memory contents are disclosed. The initial description specifies memory disclosure without providing exploit specifics. Connected Nessus entries for Word/Office July 2020 corroborate that CV...

CVE-2022-37963

CVE-2022-37963 affects Microsoft Visio (Office Visio) with a remote code execution vulnerability (CVSSv3.1 base score 7.8). The connected sources confirm it targets Visio components and that exploitation could allow arbitrary code execution, with fixes delivered via Microsoft security updates. Re...

CVE-2022-41043

CVE-2022-41043 is a Microsoft Office Information Disclosure vulnerability. The vulnerability is described with CVSS v3.1 base 3.3 (LOW), attack vector LOCAL, no user interaction, and affects Microsoft Office components (including macOS variants). Connected sources note potential access to authent...

CVE-2023-36565

CVE-2023-36565 is a Microsoft Office Graphics elevation-of-privilege vulnerability. Affected are various Office products (e.g., Office 2019/2021, Office for Mac; list from Kaspersky NCSC doc) where the Graphics component can elevate privileges within a local context. Reported root cause is a priv...