CVE-2017-0199

CVE-2017-0199 affects Microsoft Office client suites (Office 2007 SP3, 2010 SP2, 2013 SP1, 2016) and Windows platforms (Vista SP2, Server 2008 SP2, 7 SP1, 8.1). The vulnerability allows remote code execution via a crafted document, exploiting how Office components interact with the Windows API an...

CVE-2017-11882

CVE-2017-11882 is a memory corruption vulnerability in Microsoft Office's Equation Editor that affects Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016. The flaw resides in eqnedt32.exe, an out-of-process COM server, and can lead to remote code execution when a user opens a specially crafted Word do...

CVE-2018-0802

CVE-2018-0802 is a Microsoft Office memory corruption/remote code execution vulnerability in the Equation Editor, triggered by crafted OLE/embedded objects in Office documents. Affected products include Office 2007, 2010, 2013, and 2016; the issue arises from the way Office handles in-memory obje...

CVE-2012-0158

CVE-2012-0158 is a Microsoft/MSCOMCTL.OCX (MS Office) vulnerability that enables remote code execution via a crafted file or document. The initial entry lists vulnerable controls in MSCOMCTL.OCX and notes exploitation in the wild around April 2012 (aka “MSCOMCTL.OCX RCE Vulnerability”). Connected...

CVE-2017-8570

CVE-2017-8570 concerns Microsoft Office and is described as a remote code execution vulnerability caused by how Office handles objects in memory (notably monikers/embedded objects in documents). Multiple connected sources corroborate the vulnerability class as an Office memory object handling iss...

CVE-2010-3333

CVE-2010-3333 is a stack-based buffer overflow in Microsoft Office’s RTF parser (pFragments shape property) that enables remote code execution via crafted RTF data. Affected products include Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office for Mac 2004/2008, Office for Mac 201...

CVE-2018-0798

The CVE-2018-0798 entry concerns a memory corruption vulnerability in Microsoft Office (Word/Equation Editor) across Office 2007–2016. The root cause is how certain objects are handled in memory, enabling remote code execution when a specially crafted file is opened. Connected documents indicate ...

CVE-2012-1856

CVE-2012-1856 covers a remote code execution vulnerability in the TabStrip ActiveX control (MSCOMCTL.OCX) used by multiple Microsoft Office components and related products. The issue arises from a system-state corruption triggered by crafted (1) documents or (2) web pages, allowing remote attacke...

CVE-2013-3906

CVE-2013-3906 is a memory corruption vulnerability in Microsoft Windows Graphics Component (TIFF handling) that could allow remote code execution. It affected GDI+ in Windows Vista SP2/Server 2008 SP2 and Office suites (Office 2003 SP3, 2007 SP3, 2010 SP1/SP2, Office Compatibility Pack SP3) and L...

CVE-2009-0557

CVE-2009-0557 describes an Object Record Corruption vulnerability in Microsoft Office Excel across multiple platforms (Office 2000 SP3, XP SP3, 2003 SP3, Mac editions, and Excel Viewer/Compatibility Pack). The root cause is a malformed record object in an Excel file, enabling remote code executio...

CVE-2009-0563

CVE-2009-0563 is a Stack-based buffer overflow in Microsoft Word components that allows remote code execution when a user opens a crafted Word document with an invalid length field. Affected products include Word 2002 SP3, 2003 SP3, Word 2007 SP1/SP2, Office for Mac 2004/2008, Open XML File Forma...

CVE-2016-7193

Summary of CVE-2016-7193 : A memory corruption flaw in Microsoft Office’s handling of RTF documents allows remote code execution on affected Office products (Word 2007 SP2, Office 2010 SP2, Word 2013/2016, Word for Mac variants, Office Web Apps Server, etc.). The root cause is a vulnerability in ...

CVE-2015-2424

CVE-2015-2424: Microsoft Office memory corruption in PowerPoint/Word components allows remote code execution or memory corruption via a crafted Office document. Affected products include PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, an...

CVE-2015-2545

CVE-2015-2545 affects Microsoft Office (2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1) via a crafted EPS image that triggers memory corruption during EPS parsing, enabling remote code execution. FireEye details describe an EPS-encoded use-after-free in Office’s EPS handling (dict copy/forall flow) le...

CVE-2015-1642

CVE-2015-1642 affects multiple Microsoft Office products (Office 2007 SP3, 2010 SP2, 2013 SP1) via memory corruption when parsing crafted Office files, allowing remote code execution. Microsoft issued MS15-081 with a suite of updates (e.g., 2687409 for Office 2007/2010/2013 components and related...

CVE-2017-0281

CVE-2017-0281 / CVE-2017-0262 describe a remote code execution flaw in Microsoft Office and related components triggered by memory handling errors while processing specially crafted Office files (EPS in particular). Affected products include Office 2010 SP2, Office 2013 SP1, Office 2016, and broa...

CVE-2017-0243

CVE-2017-0243 is a Microsoft Office remote code execution vulnerability caused by how Office handles objects in memory. An attacker could trigger RCE by convincing a user to open a crafted document. The entry notes this CVE is distinct from CVE-2017-8570. From the metrics, the CVSS v3 base score ...

CVE-2012-1854

The CVE-2012-1854 entry describes an insecure library loading vulnerability in Microsoft Visual Basic for Applications (VBA) via VBE6.dll. Affected products include Microsoft Office 2003 SP3, 2007 SP2/SP3, and 2010 Gold/SP1, with VBA and Summit VBA SDK also implicated. The root cause is untrusted...

CVE-2016-7182

CVE-2016-7182 is a true‑type font parsing elevation of privilege vulnerability in the Windows Graphics component. The flaw affects multiple Windows OS versions (Vista SP2, Server 2008 SP2/R2 SP1, Windows 7/8.1/10, Windows Server 2012 R2, Windows RT 8.1, Office 2007/2010, Word Viewer, Skype for Bu...

CVE-2015-6108

CVE-2015-6108 affects the Windows font library across multiple Windows OS versions (Vista through Windows 8.1/Server 2012) and related Microsoft products, where a crafted embedded font can trigger remote code execution. The vulnerability is described as a memory corruption issue in handling embed...

CVE-2018-0812

The CVE-2018-0812 entry describes a remote code execution vulnerability in Equation Editor across Office products (Word/Office 2003, 2007, 2010, 2013, 2016) due to how objects are handled in memory. The issue affects Word/Office components when processing crafted files, enabling code execution on...

CVE-2013-0007

CVE-2013-0007 impacts Microsoft XML Core Services (MSXML) versions 4.0–6.0. A parsing fault in MSXML can allow remote code execution when a user visits a crafted web page (MSXML XSLT vulnerability). Affected components include MSXML DLLs; root cause is improper XML content parsing. Mitigation is ...

CVE-2012-0167

CVE-2012-0167 is a heap-based buffer overflow in the Office GDI+ library affecting Microsoft Office 2003 SP3 and 2007 SP2/SP3. It allows remote attackers to execute arbitrary code by crafting an EMF image embedded in an Office document, i.e., the “GDI+ Heap Overflow Vulnerability.” The issue is t...

CVE-2012-0165

CVE-2012-0165 targets GDI+ EMF processing in Windows and Office, where EMF record type validation is insufficient, enabling remote code execution via a crafted image. Affected: Windows Vista SP2, Windows Server 2008 SP2, and Office 2003 SP3, Office 2007 SP2/SP3, and Office 2010 Gold/SP1 (GDI+). I...

CVE-2012-0159

CVE-2012-0159 is a kernel-level remote code execution vulnerability in Microsoft Windows related to TrueType font parsing. The root cause is a sign extension error in the kernel’s handling of TrueType compound glyphs within win32k.sys, which can be triggered by a crafted TTF file. Affected produc...

CVE-2017-0283

CVE-2017-0283 is described in the connected MSKB as a remote code execution vulnerability in Microsoft Office components that could be triggered by opening a specially crafted Office file. The MSKB describes a security update KB3191937 for Skype for Business 2015 (Lync 2013) that addresses CVE-20...

CVE-2017-0108

CVE-2017-0108 is a remote-code-execution vulnerability in the Windows Graphics Component, exploited via untrusted fonts processed by Uniscribe (usp10.dll) and exposed through graphics-related API calls invoked by user32/draw text paths. Google Project Zero’s Uniscribe fuzzing identified 8 high‑se...

CVE-2009-2500

This CVE corresponds to MS09-062: GDI+ WMF Integer Overflow Vulnerability. Affected are Microsoft GDI+ image-processing paths used by WMF, PNG, TIFF, BMP handling across Windows components and Office/Viewer products (e.g., IE6, Office suites, Visio, Project, SQL/Report Viewer, Forefront Client Se...

CVE-2017-8509

CVE-2017-8509 is an Office remote code execution vulnerability that arises when Office components mishandle objects in memory, allowing an attacker to take control of an affected system if a user opens a crafted Office file. Public details in connected documents indicate the vulnerability affects...

CVE-2017-8527

Technical details for CVE-2017-8527 are not publicly available in the provided documents. No specifics on affected products, vulnerable components, root cause, exploits, or fixes are included here. Monitor for updates from official advisories.

CVE-2009-2528

CVE-2009-2528 is a memory corruption vulnerability in GDI+ used by Microsoft Office XP/2000 when parsing Office Art Property Tables. A crafted Office document can trigger remote code execution. Microsoft Security Bulletin MS09-062 (KB957488) provides patches; apply the MS09-062 updates to remedia...

CVE-2009-3126

CVE-2009-3126 corresponds to the GDI+ PNG Integer Overflow vulnerability described in MS09-062. The issue arises from an integer overflow in GDI+ when processing PNG images, which could allow remote code execution if a user opens a specially crafted image. The vulnerability affects a wide range o...

CVE-2011-1988

Microsoft Excel heap memory corruption vulnerability (MS11-072) tied to parsing BIFF2 records in Excel files can allow remote code execution. Affected products include Excel 2003 SP3, 2007 SP2, Office 2007 SP2, Office for Mac variants, Open XML Converter for Mac, Excel Viewer SP2, and related Mac...

CVE-2008-1434

CVE-2008-1434 describes a remote code execution vulnerability in Microsoft Word caused by a memory handling error when processing a Word file containing a malformed CSS value. The issue affects Word across multiple products/versions (Office 2000 SP3, Word 2000; Word XP SP3; Word 2003 SP2/SP3; Wor...

CVE-2016-0145

CVE-2016-0145 is a Graphics Memory Corruption vulnerability in the Windows font library. A remote attacker can execute arbitrary code by delivering a crafted embedded font, affecting Windows flavors listed in the vulnerability entry (e.g., Windows Vista through Windows 10 versions, Windows Server...

CVE-2011-1983

The CVE-2011-1983 vulnerability is a Word use-after-free in Microsoft Office Word 2007/2010 (including SP2/SP3, Gold SP1) and Word for Mac 2011. The flaw occurs when Word handles a border object with a specific property, freeing memory during parsing, which can lead to remote code execution under...

CVE-2013-0006

CVE-2013-0006 is associated with OSIsoft PI Interface for OPC XML-DA (ICS advisory ICSA-20-315-01) and Microsoft MSXML/MS13-002 context. Connected documents identify the affected product as PI Interface for OPC XML-DA versions prior to 1.7.3.x, where the vulnerability stems from numeric errors/st...

CVE-2017-0073

Technical details for CVE-2017-0073 are not publicly available in the provided connected documents. The records summarize the vulnerability, but no product/version specifics or exploit information are shown. Monitor for updates from official sources.

CVE-2018-0851

CVE-2018-0851 affects multiple Microsoft Office versions: Office 2007 SP2, Word Viewer, Office 2010 SP2, Office 2013 SP1/RT SP1, Office 2016, and Office 2016 Click-to-Run. The vulnerability arises from how Office handles objects in memory, described as a memory corruption issue that enables remot...

CVE-2017-0060

The CVE-2017-0060/0062 issue affects the Graphics Device Interface (GDI) in multiple Windows releases (Vista through Windows 10 variants listed in the initial entry). The vulnerability enables a remote attacker to obtain sensitive information from process memory by visiting a crafted web site, i....

CVE-2012-0177

CVE-2012-0177 affects the Office Works File Converter in Microsoft Office 2007 SP2, Works 9, and Works 6–9 File Converter. The vulnerability is a heap-based buffer overflow when parsing .wps (Works) files, enabling remote code execution. The attacker could trigger this without user interaction, p...

CVE-2015-2464

CVE-2015-2463 and CVE-2015-2464 describe a TrueType font parsing vulnerability that allows remote code execution. Affected products include Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8/8.1, Windows Server 2012 Gold/R2, Windows RT 8.1, Office 2007 SP3 and 2010 SP2, L...

CVE-2016-3304

CVE-2016-3304 is the Windows Graphics Component remote code‑execution vulnerability where the Windows font library improperly handles crafted embedded fonts, affecting Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, Windows 7 SP1, Office 2007 SP3/2010 SP2, Word Viewer, Skype for Business 2016,...

CVE-2012-2524

The CVE-2012-2524 issue affects Microsoft Office 2007 SP2/SP3 and Office 2010 SP1 (32/64-bit) where parsing a crafted CGM file triggers memory corruption, enabling remote code execution or memory denial of service. Root cause: memory corruption during CGM processing in Office components (mso.dll/...

CVE-2013-1325

CVE-2013-1325 is a heap-based buffer overflow in Microsoft Office 2003 SP3 and Office 2007 SP3 triggered by parsing WordPerfect (.wpd) documents, allowing remote code execution. Affected products parse WPD files and fail due to the underlying heap overflow, enabling arbitrary code execution when ...

CVE-2013-3854

CVE-2013-3854 affects Microsoft Office 2007 SP3 and Word 2007 SP3. The vulnerability is described as memory corruption in Word that can be triggered by a crafted Office document, enabling remote code execution or, per the description, a denial of service. The CVSSv2 base score is 9.3 (HIGH) with ...

CVE-2016-3301

CVE-2016-3301 affects the Windows Graphics Component in the Windows font library, enabling remote code execution via a crafted embedded font. Affected products include Windows Vista SP2; Windows Server 2008 SP2/R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; W...

CVE-2018-0804

The CVE-2018-0804 entry concerns a remote code execution in the Equation Editor of Microsoft Office 2003–2016 due to the way in-memory objects are handled. Affected software includes Office 2003, 2007, 2010, 2013, and 2016; the root cause is improper handling of objects in memory within the Equat...

CVE-2016-3209

CVE-2016-3209 affects Microsoft GDI+ across Windows Vista/7/8.1/Server 2008-2012 and various Office/.NET components, enabling information disclosure by bypassing ASLR through unspecified vectors. Connected sources confirm exploitation activity (e.g., Exploit DB). Public references note MS16-120 a...

CVE-2009-2501

CVE-2009-2501 describes a heap-based buffer overflow in Microsoft GDI+ when processing PNG images, enabling remote code execution via crafted PNGs. Affected software/contexts include Internet Explorer 6 SP1 on Windows XP (SP2/SP3) and various Microsoft Office components and viewers that rely on G...