CVE-2022-41061

CVE-2022-41061 is a Microsoft Word remote code execution vulnerability. The CVSS v3.1 base score is 7.8 (HIGH), with LOCAL attack vector, LOW attack complexity, and user interaction required; impact is high for confidentiality, integrity, and availability. Affected: Microsoft Word / Office compon...

CVE-2013-3850

CVE-2013-3850 is a memory corruption vulnerability in Microsoft Word components that allows remote code execution or a denial of service when processing a crafted Office document. Affected products include Word 2003 SP3, 2007 SP3, 2010 SP1/SP2, Office Compatibility Pack SP3, and Word Viewer. Root...

CVE-2017-0254

CVE-2017-0254 concerns a remote code execution in Microsoft Office applications (Word, PowerPoint, etc.) and related components when the software fails to properly handle objects in memory. The vulnerability affects multiple Office products across Windows and macOS (e.g., Word 2007, Office 2010 S...

CVE-2020-0980

CVE-2020-0980 is a Microsoft Word remote code execution vulnerability caused by improper handling of in-memory objects. It affects Word/Office when parsing crafted files; the impact is potential code execution in the current user context. In public docs, the vulnerability is addressed by the Offi...

CVE-2022-41060

CVE-2022-41060 is a Microsoft Word information disclosure vulnerability. The connected documents reference Word/Office components affected by the November 2022 updates and Office Web Apps Server updates (e.g., KB5002261, KB5002276) addressing Word information disclosure and related vulnerabilitie...

CVE-2018-0804

The CVE-2018-0804 entry concerns a remote code execution in the Equation Editor of Microsoft Office 2003–2016 due to the way in-memory objects are handled. Affected software includes Office 2003, 2007, 2010, 2013, and 2016; the root cause is improper handling of objects in memory within the Equat...

CVE-2026-45458

Microsoft Office (including Outlook and Word) is affected by CVE-2026-45458 due to a type-confusion in resource access, enabling local code execution. The vulnerability arises when an incompatible type is accessed, with a local attack vector, no user interaction, and no privileges required. The C...

CVE-2013-3856

CVE-2013-3856 affects Microsoft Word 2003 SP3 and Word Viewer. A memory corruption flaw in crafted Office documents allows remote code execution or a denial of service. Affected products are Word 2003 SP3 and Word Viewer; the vulnerability is addressed by Microsoft MS13-072 (security update). The...

CVE-2020-1342

CVE-2020-1342 is an information-disclosure vulnerability in Microsoft Office (notably Word/Office components) caused by reading out of bound memory due to an uninitialized variable. The detail explicitly states memory contents could be disclosed when a vulnerable file is opened in affected Office...

CVE-2019-0953

CVE-2019-0953 is a remote-code-execution vulnerability in Microsoft Word caused by improper handling of objects in memory. The issue affects Word components across Office clients (notably Word 2016/2019) and can be triggered by a specially crafted file, enabling code execution in the caller’s sec...

CVE-2025-62562

CVE-2025-62562 is a Microsoft Outlook remote code execution vulnerability identified in Office Outlook. The connected sources describe it as a use-after-free in Outlook, enabling an attacker to execute arbitrary code locally. Affected product: Microsoft Outlook (part of Microsoft Office). Underly...

CVE-2013-3854

CVE-2013-3854 affects Microsoft Office 2007 SP3 and Word 2007 SP3. The vulnerability is described as memory corruption in Word that can be triggered by a crafted Office document, enabling remote code execution or, per the description, a denial of service. The CVSSv2 base score is 9.3 (HIGH) with ...

CVE-2020-1503

CVE-2020-1503 is an information-disclosure vulnerability in Microsoft Word where memory contents can be disclosed through a crafted Word document. The root cause is improper handling of in‑memory objects, enabling disclosure of memory contents when a user opens a malicious document. Exploitation ...

CVE-2022-41103

CVE-2022-41103 is Microsoft Word Information Disclosure Vulnerability. Connected sources indicate it is referenced alongside Word/Office and SharePoint update bundles (e.g., Word C2R and SharePoint November 2022 patches). The vulnerability is described as information disclosure; no explicit root-...

CVE-2013-3891

CVE-2013-3891 is a memory corruption vulnerability in Microsoft Word 2003 SP3 that enables remote code execution via a crafted Office document. The issue affects Word/Office parsing logic and leads to arbitrary code execution on vulnerable systems. Public documents corroborate the vulnerability a...

CVE-2013-3852

CVE-2013-3852 affects Microsoft Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer. The vulnerability is a memory corruption flaw in Word that can be triggered by a crafted Office document, enabling remote code execution or a denial of service. The OpenVAS...

CVE-2017-11854

CVE-2017-11854 affects Microsoft Word 2007 SP3, Word 2010 SP2, Office 2010 SP2, and Office Compatibility Pack SP3. The root cause is improper handling of memory-resident objects, enabling arbitrary code execution in the context of the current user when a specially crafted file is opened. In the d...

CVE-2020-1229

CVE-2020-1229 is a security feature bypass in Microsoft Outlook/Office where security settings aren’t enforced, allowing an attacker to craft an image that, when opened, could cause the system to load remote images and reveal the target’s IP address. Exploitation requires user interaction (openin...

CVE-2021-1716

CVE-2021-1716 is a Microsoft Word Remote Code Execution vulnerability. The initial entry confirms a Word-related RCE with CVSS v3.1 base score 7.8 (HIGH) and local attack vector, with user interaction required. Connected sources (Nessus/Office/SharePoint plugin data) reference CVE-2021-1716 as pa...

CVE-2020-0892

CVE-2020-0892 is a Microsoft Word remote code execution vulnerability. The linked documents confirm Word is vulnerable when it fails to properly handle objects in memory, allowing a crafted file to run code in the current user’s context. The issue is tied to multiple Word-related CVEs and is disc...

CVE-2020-1218

CVE-2020-1218 – Microsoft Word Remote Code Execution : A vulnerability in Word where memory handling of in-file objects can be corrupted by a specially crafted file. An attacker could exploit this via email or a compromised website by convincing a user to open the crafted Word document, executing...

CVE-2018-0792

CVE-2018-0792 is a remote-code-execution vulnerability in Word 2016/Microsoft Office 2016, caused by unsafe handling of in-memory objects. Affected software includes Word 2016 (Office 2016). The vulnerability could allow an attacker to execute arbitrary code on a vulnerable host when a specially ...

CVE-2018-8573

CVE-2018-8573 is a remote code execution vulnerability in Microsoft Word/Office products caused by improper handling of objects in memory. The vulnerability could allow an attacker to execute arbitrary code in the security context of the current user when a specially crafted file is opened. Multi...

CVE-2020-17020

CVE-2020-17020: Microsoft Word Security Feature Bypass vulnerability. Affects Word (e.g., Word 2016 era). Root cause not explicitly detailed in the provided docs. Local attack vector with low complexity; attacker could bypass security features without user interaction via a crafted file, with con...

CVE-2024-41165

CVE-2024-41165 affects Microsoft Word 16.83 for macOS. Talos reports a library-injection vulnerability where a malicious library loaded via relative paths and the app’s hardened runtime with com.apple.security.cs.disable-library-validation enabled could be used to bypass permissions and reuse Wor...

CVE-2016-0012

CVE-2016-0012 affects Microsoft Office suite (2007–2016 and related components) and is described as a security feature/ASLR bypass vulnerability. Connected OpenVAS entries explicitly reference remote bypass vectors in Office components (PowerPoint, Visio, Word, Excel, VB runtime) and note exploit...

CVE-2020-1447

CVE-2020-1447 is a Microsoft Word remote code execution vulnerability tied to how Word handles objects in memory. Connected sources corroborate that it affects Word and can allow an attacker to run code in the context of the current user when a specially crafted file is opened or processed. The N...

CVE-2016-3316

CVE-2016-3316 is a remote-code-execution vulnerability in Microsoft Office Word (Word 2013 SP1/RT SP1, 2016, and Word 2016 for Mac) caused by improper handling of memory objects when opening a crafted file. Public sources describe exploitation via specially crafted Word documents to execute arbit...

CVE-2017-0003

CVE-2017-0003 affects Microsoft Word 2016 and SharePoint Enterprise Server 2016 (Office memory corruption vulnerability). The underlying issue is a memory handling flaw that can allow remote code execution when a specially crafted Office file is opened. In affected products, exploitation requires...

CVE-2019-1034

CVE-2019-1034 affects Microsoft Word/Office where in-memory handling of objects can be exploited to run remote code after a user opens a crafted file. Exploitation relies on social/vector delivery (email or web), with the attacker gaining the same rights as the logged-on user. The vulnerability i...

CVE-2026-40361

CVE-2026-40361 is a Use-After-Free vulnerability in Microsoft Word that allows local code execution without user interaction. Affected product: Word (Office). Underlying issue: use-after-free in a Word component leading to arbitrary code execution. CVSS 3.1 base score 8.4 (HIGH) with local attack...

CVE-2019-0561

CVE-2019-0561 is an information-disclosure vulnerability in Microsoft Word/Office related to improper handling of Word fields, specifically via Word macro buttons. The issue allows reading arbitrary files from the targeted system. Multiple Nessus/OpenVAS entries and advisories group CVE-2019-0561...

CVE-2020-1445

CVE-2020-1445 is an information disclosure vulnerability in Microsoft Office (notably Word) related to how memory contents are disclosed. The initial description specifies memory disclosure without providing exploit specifics. Connected Nessus entries for Word/Office July 2020 corroborate that CV...

CVE-2015-2503

CVE-2015-2503 is an Office Elevation of Privilege vulnerability that can be triggered via a crafted web site loaded in Internet Explorer to bypass sandbox protections and gain privileges. The initial CVE entry lists Microsoft Office 2007–2016 products (Word, Excel, PowerPoint, Access, InfoPath, V...

CVE-2016-0022

CVE-2016-0022 corresponds to a memory corruption vulnerability in Microsoft Office components (Word and related Word/Office Suite on Windows and Mac) that could allow remote code execution via a crafted Office document. Connected sources indicate this is tied to MS16-015 and affects Word 2007 SP3...

CVE-2025-24078

CVE-2025-24078 is a use-after-free vulnerability in Microsoft Word that can allow a local attacker to execute arbitrary code. The flaw is documented as a Microsoft Word Remote Code Execution issue with a CVSS v3.1 base score of 7.0 (High, Local exploitability, user interaction required). The vuln...

CVE-2025-47168

CVE-2025-47168 (Microsoft Word RCE) is a use-after-free vulnerability in Word that allows an attacker to execute code locally after triggering with a crafted file or object. The issue is in Word component handling, leading to arbitrary code execution with the attacker’s privileges; the CVSS detai...

CVE-2014-1757

CVE-2014-1757 is the Microsoft Office file format converter memory corruption vulnerability affecting Word 2007 SP3, Word 2010 SP1/SP2, and Office Compatibility Pack SP3. The issue occurs when converting legacy binary (.doc) documents to newer formats, allowing remote attackers to execute arbitra...

CVE-2016-0183

Summary: CVE-2016-0183 is a remote code execution flaw in the Windows font library used by Microsoft Office components (Office 2010 SP2, Word 2010 SP2, Word Automation Services on SharePoint Server 2010 SP2, Office Web Apps 2010 SP2). What’s affected: Windows Font Library within affected Office p...

CVE-2017-0031

CVE-2017-0031 affects Microsoft Office components: Office 2010 SP2, Office Compatibility Pack SP3, Word 2007 SP3, and Word 2010 SP2. It allows remote code execution or memory corruption via a crafted document, with the underlying issue described as a memory corruption vulnerability in Office. The...

CVE-2017-8510

CVE-2017-8510 describes a remote code execution vulnerability in Microsoft Office caused by improper handling of objects in memory. The CVE entry notes an Office remote code execution risk with a high impact (C/H/I/A) and a network attack vector, requiring user interaction. The description provid...

CVE-2018-8430

CVE-2018-8430 is a Word/Office remote code execution vulnerability triggered when a user opens a specially crafted PDF file. The affected product is Microsoft Word (Office). The root cause is in how Word parses PDF content, enabling arbitrary code execution in the context of the current user. Pub...

CVE-2020-1448

CVE-2020-1448 corresponds to a Remote Code Execution vulnerability in Microsoft Word. The issue arises when Word fails to properly handle objects in memory, enabling an attacker to run code in the context of the current user. The connected Nessus entries corroborate that CVE-2020-1448 is grouped ...

CVE-2018-0950

CVE-2018-0950: Microsoft Office information disclosure via RTF email rendering. Affected: Office/Word on Windows. Root cause: memory contents disclosure when rendering RTF messages with OLE objects; error in how Office handles memory disclosure. Impact: potential leakage of memory contents to a r...

CVE-2025-49703

CVE-2025-49703 is a Microsoft Word/Office remote code execution vulnerability caused by a use-after-free condition in Word. Affected products include Word/Office; exploitation yields local code execution with High impact per the CVSS (Local access, user interaction required, high confidentiality/...

CVE-2016-3234

CVE-2016-3234 affects Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint 2010 SP2/2013 SP1, Office Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1. The root cause is an information disclosure flaw that...

CVE-2016-3279

CVE-2016-3279 is a remote code execution vulnerability in multiple Microsoft Office components (e.g., Excel, Word, PowerPoint, Word Automation Services, Office Web Apps) that can be triggered by processing a crafted XLA file. Affected products include Office 2010 SP2, 2013 SP1/RT SP1, 2016, Word ...

CVE-2014-4117

CVE-2014-4117 affects Microsoft Office and related components (Word 2007/2010, Office 2010, Office for Mac 2011, Word Web Apps, SharePoint) where remote code execution is possible via crafted Word document properties. Root cause: improper handling/parsing of Word file format elements allows arbit...

CVE-2015-0085

CVE-2015-0085 is a use-after-free vulnerability in Microsoft Office components (including Office 2007/2010/2013 suites and related SharePoint/Viewer components) that enables remote code execution via a crafted Office document. The issue affects a broad set of Office applications and SharePoint-re...

CVE-2017-0029

CVE-2017-0029 affects Microsoft Office components, notably Word 2010 SP2, Word 2013 RT SP1, and Word 2016, where a crafted Office document can cause an application hang (denial of service). The root cause is described across connected records as remote denial of service via specially crafted Offi...