365 Apps
Monthly
Command injection in Microsoft OneNote allows an unauthenticated remote attacker to execute code when a victim opens a specially crafted OneNote document. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and affects Microsoft 365 Apps for Enterprise 16.0.1 per EUVD, with user interaction being the primary exploitation barrier. No public exploit was identified at time of analysis, and Microsoft has published an advisory and update path via the MSRC update guide.
Heap-based buffer overflow in Microsoft Office Excel lets an unauthenticated remote attacker execute arbitrary code on a target system when the victim opens or previews a specially crafted spreadsheet, as described in Microsoft's MSRC update guide. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms no privileges or credentials are needed, but the required user interaction makes phishing delivery of the malicious file the practical attack path, with any code running at the privilege level of the user who opens it. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024, Office for Mac (365/2021/2024), and Office Online Server, so this is a broad default-installation exposure; no public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published an update so patching is the decisive control.
Remote code execution in Microsoft Excel occurs when a user opens an attacker-crafted spreadsheet, exploiting an integer overflow (wraparound) that corrupts memory while Excel processes the file. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): the attacker needs no credentials and can deliver the file over the network, but successful exploitation hinges on the victim opening the document, so real-world attacks depend on social engineering or malicious file delivery rather than autonomous remote compromise. Affected builds include Office LTSC 2021 and 2024, Office Online Server, the Mac LTSC and 365 editions, and Microsoft 365 Apps for Enterprise; this is a genuine high-priority vulnerability, though there is no public exploit identified at time of analysis, and a vendor patch is available.
Heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code in the security context of the current user when a victim opens an attacker-supplied workbook, rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No authentication or prior privileges are required, but exploitation is gated by user interaction - the attacker must deliver a malicious Excel file (typically by email, link, or download) and persuade the target to open or preview it, so the AV:N vector reflects file delivery over the network rather than a directly reachable network service. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and Microsoft has shipped patched builds for the Windows Office and Office Online Server editions while macOS fixes remain pending publication.
Remote code execution in Microsoft Excel is possible via a heap-based buffer overflow that an unauthenticated attacker can trigger by convincing a targeted user to open a specially crafted workbook (UI:R), with code running in the context of that user. No public exploit code was identified at time of analysis, and the required user interaction - typically a phishing attachment, web-hosted document, or file-share lure - is the primary limiting factor on practical exploitation. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2024 and LTSC 2021, Office LTSC/365 for Mac, and Office Online Server, making this a genuine patch-priority item for environments still on vulnerable builds.
Opening or previewing an attacker-supplied Excel spreadsheet can allow a remote, unauthenticated attacker to run code in the security context of the user who opened the file on affected Windows and macOS Office builds (Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and the corresponding Mac editions). The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so while delivery is remote via email or web, exploitation is gated by user interaction - the victim must open the crafted document - and the resulting impact is bounded by that user's privileges. No public exploit code has been identified at time of analysis and the vendor has released patches, so this is a patching-priority item rather than a confirmed actively exploited or wormable remote flaw.
Local privilege escalation in Microsoft Office Click-To-Run (C2R) arises from a time-of-check time-of-use race condition in the installer/updater's file handling, letting an authorized low-privileged local user substitute attacker-controlled content in the window between validation and use and thereby gain higher privileges on the host. The flaw is rated CVSS 3.1 base 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it is strictly local, requires a pre-existing authenticated session, needs no victim interaction, but is timing-dependent and therefore probabilistic - repeated attempts may be needed to win the race. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so this is a privilege-escalation primitive for an attacker who already holds a local foothold rather than a remotely reachable or actively exploited issue. Deployments affected are Microsoft 365 Apps for Enterprise installed via Click-To-Run (reported as version 16.0.1).
Heap-based buffer overflow in Microsoft Excel enables remote, unauthenticated attackers to execute arbitrary code in the context of the logged-on user when the victim opens a maliciously crafted Excel document. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R vector, no credentials or prior access are required and attack complexity is low, with the only meaningful barrier being the mandatory user interaction of opening the file; Microsoft rates this 8.8 High, and a vendor patch is available from Microsoft (MSRC update guide for CVE-2026-97773). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the broad install base of Microsoft 365 Apps and Office LTSC makes prompt patching important. This is a credible high-priority issue.
Remote code execution in Microsoft Excel affects Office LTSC 2021, LTSC 2024, Office Online Server, Microsoft 365 Apps, and Mac editions when a victim opens a specially crafted spreadsheet (UI:R). An unauthenticated attacker (PR:N) can trigger a double free (CWE-415) to corrupt memory and execute code in the context of the user; no public exploit has been identified. Although high severity (CVSS 8.8), exploitation requires user interaction and is not zero-click, and vendor patches are available.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code on a victim's machine when the victim opens a maliciously crafted spreadsheet, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 (Windows and Mac), Office Online Server, and Office 365 for Mac. The defect is a use-after-free memory-corruption issue (CWE-416) rated CVSS 8.8 with full impact to confidentiality, integrity, and availability, but exploitation hinges on the user-interaction prerequisite (CVSS UI:R) of opening the file - it is not a remote code path that fires without a user action. No public exploit code has been identified and there is no CISA KEV confirmation of active exploitation at time of analysis; vendor patches are available, so this is a high-priority but not currently urgent-tier issue given the absence of exploitation signals.
Stack-based buffer overflow in Microsoft Excel allows an unauthenticated remote attacker to execute arbitrary code in the context of the user who opens or previews a specially crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, corresponding Mac editions, and Office Online Server; exploitation requires user interaction (UI:R), and no public exploit was identified at time of analysis. Vendor patches are available, with fixed builds such as 16.0.17932.21056 for Office LTSC 2024.
Heap-based buffer overflow in Microsoft Office Excel lets a remote, unauthenticated attacker execute code when a victim opens or previews a specially crafted Excel workbook in an affected Office build. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/SU/C:H/I:H/A:H means the attacker needs the user to interact with the malicious file, not a server-side or fully unauthenticated service exploit, despite the network attack-vector label. Microsoft has released patches per the MSRC advisory; no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code in the context of the user who opens a specially crafted spreadsheet. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), no authentication or prior privileges are required, but exploitation is conditional on the victim opening the malicious file - there is no zero-click path, which is the defining prerequisite and the primary limiting factor. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021 (Windows and Mac), Office LTSC/365 for Mac, and Office Online Server; there is no public exploit identified at time of analysis, and no CISA KEV listing, though Microsoft has published a vendor fix.
Arbitrary code execution in Microsoft Office Excel is possible when a user opens a specially crafted workbook, because the parser mishandles memory and triggers a double free (CWE-415). The flaw is remotely deliverable by an unauthenticated attacker (CVSS 3.1 AV:N/AC:L/PR:N), but exploitation depends on the victim opening the malicious file (UI:R), limiting the attack to social-engineering delivery; successful exploitation runs code with the privileges of the opening user. Affected software includes Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office for Mac builds, and Office Online Server builds below the fixed versions, and a vendor patch is available; no public exploit code or confirmed active exploitation was identified at the time of analysis.
Heap-based buffer overflow in Microsoft Excel allows remote code execution when a victim opens an attacker-crafted spreadsheet in a vulnerable build, including Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office for Mac, and Office Online Server. The attack is unauthenticated from the attacker's side but requires user interaction (UI:R), meaning the target must open or preview the file, after which code executes in that user's security context. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV, though vendor patches are available and should be treated as a high-priority patch item.
Code execution in Microsoft Excel is possible when an unauthenticated remote attacker convinces a user to open a specially crafted workbook, triggering a heap-based buffer overflow (CWE-122) that can corrupt memory and allow arbitrary code to run in the context of the application. The flaw affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office Online Server, and the listed Mac LTSC/365 builds, with exploitation requiring user interaction to open the document (UI:R). Microsoft has released patched versions for the Windows and server builds, and no public exploit identified at time of analysis.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to compromise affected systems when a victim opens or previews a maliciously crafted workbook. This heap-based buffer overflow affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows and Mac), Office 365 for Mac, and Office Online Server; a vendor patch is available. No public exploit code has been identified at time of analysis, and while exploitation requires user interaction, the vulnerability is high priority but not an emergency 'patch-tonight' situation.
Remote code execution in Microsoft Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows and Mac, Office 365 for Mac, and Office Online Server) allows an unauthenticated remote attacker to execute code with the victim's privileges by convincing them to open or preview a specially crafted workbook. The flaw is an out-of-bounds write (CWE-787) triggered during file parsing, and exploitation hinges on the required user interaction (CVSS UI:R); no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. Microsoft has released patches-Office LTSC 2024 16.0.17932.21056, Office LTSC 2021 16.0.14334.20974, and Office Online Server 16.0.10417.20228-making this a genuine patch-priority item but not a drop-everything emergency.
Stack-based buffer overflow in the Excel document parser allows a remote, unauthenticated attacker to execute code in the context of the current user when a victim opens a maliciously crafted spreadsheet. Exploitation requires user interaction (UI:R) - the file must be opened - and the attacker gains no elevated privileges, with code running locally rather than as SYSTEM or root, though impact to confidentiality, integrity and availability is rated high for that user context. The flaw affects Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and Office LTSC for Mac 2021/2024, and a vendor patch is available; no public exploit code was identified at time of analysis and exploitation has not been confirmed as active (no CISA KEV listing), so risk is driven by the large Office install base and the ease of delivering a file by email or web rather than by observed attacks.
Memory corruption in Microsoft Excel lets a remote, unauthenticated attacker execute code in the context of the user who opens a specially crafted spreadsheet. The flaw is a use-after-free (CWE-416) triggered while Excel parses the malicious document, and it affects Microsoft 365 Apps for Enterprise, Office LTSC 2024 and 2021 on Windows, and Office/Office LTSC for Mac 2021 and 2024. The decisive limiting factor is the required user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8): there is no zero-click or server-side path, so exploitation depends on social engineering to get a victim to open the file; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied. This makes it a genuine high-priority patch item rather than a drop-everything emergency.
Heap-based buffer overflow in Microsoft Excel enables remote code execution when a user opens or previews a specially crafted spreadsheet, rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R). Any affected build - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office LTSC for Mac 2021/2024, Microsoft Office 365 for Mac, or Office Online Server - that processes the malicious file is at risk; no authentication or non-default configuration is required, but the attacker must convince the victim to open the document. No public exploit identified at time of analysis, and the flaw is not confirmed as actively exploited, though the high confidentiality, integrity, and availability impact makes it a priority patch for Office endpoints.
Heap-based buffer overflow in Microsoft Office Excel allows unauthenticated remote attackers to execute code by convincing a user to open a specially crafted Excel file. Exploitation requires user interaction and can be blocked by Protected View, but the high impact (CVSS 8.8) makes patching a high priority even though no public exploit has been identified at the time of analysis.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code in the context of a victim user by convincing them to open a crafted spreadsheet that triggers a heap-based buffer overflow (CWE-122). CVSS 3.1 rates this 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), confirming no attacker credentials are needed but requiring user interaction (opening the file, typically via phishing or a malicious download); the code executes with the victim's privileges, so a low-privileged account limits the immediate impact. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 and LTSC for Mac, Office 365 for Mac, and Office Online Server below patched versions like 16.0.14334.20974, 16.0.17932.21056, and 16.0.10417.20228, and no public exploit or KEV listing is confirmed at time of analysis.
Out-of-bounds read in Microsoft Excel enables remote code execution (CVSS 8.8) when a user opens or previews a specially crafted workbook, requiring user interaction (UI:R) but no attacker authentication (PR:N). Affected products include Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365/LTSC for Mac, Office Online Server, and SharePoint Server Subscription Edition builds prior to vendor-fixed versions, so server-side document rendering can broaden exposure. No public exploit identified at time of analysis, and vendor patches are available; the primary limiting factor is the required user action.
Heap-based buffer overflow in Microsoft Excel allows unauthenticated attackers to execute arbitrary code in the context of the user who opens a maliciously crafted workbook, with the file delivered over the network (CVSS:3.1/AV:N/AC:L/PR:N/UI:R). Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office Online Server, and Office LTSC for Mac; no public exploit identified at time of analysis, and vendor patches remove the condition.
Remote code execution in Microsoft Excel is possible when a user opens a specially crafted workbook, driven by a heap-based buffer overflow. Affected versions include Microsoft Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Office Online Server before 16.0.10417.20228, Microsoft 365 Apps for Enterprise, and the listed macOS Office builds; the CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No public exploit was identified at time of analysis and no CISA KEV entry is provided, but the mandatory user interaction makes social engineering the practical attack path, and vendor patches are available.
Use-after-free in Microsoft Excel enables remote code execution when a victim opens an attacker-crafted workbook; the attacker needs no authentication (PR:N) but must convince the user to open the file (UI:R), as reflected in the assessed CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Successful exploitation runs code in the context of the opening user with high confidentiality, integrity, and availability impact, and default Excel configurations on the listed builds are affected. Vendor patches are available with specific fix builds (e.g., 16.0.14334.20974 for Office LTSC 2021, 16.0.17932.21056 for Office LTSC 2024, and 16.0.10417.20228 for Office Online Server), and no public exploit code was identified at time of analysis, making this a genuine high-priority patch-worthy issue but not an emergency at the time of analysis.
Heap-based buffer overflow in Microsoft Excel (CWE-122) lets an unauthenticated attacker execute arbitrary code in the context of the victim's user account when that user opens a specially crafted spreadsheet; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) reflects full confidentiality, integrity and availability impact but is gated by mandatory user interaction. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 on Windows and Mac, Office 365 for Mac, and Office Online Server, so both endpoint document handling and server-side file rendering are in scope. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but with a vendor patch already published it is a high-priority patching candidate for environments that routinely open externally sourced Office files rather than a drop-everything emergency.
Stack-based buffer overflow in Microsoft Excel enables remote code execution against affected builds when a victim opens an attacker-crafted spreadsheet; the memory-corruption flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so no credentials or prior access are needed, but successful exploitation hinges entirely on the target user opening the malicious document. Exposure spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 on Windows, Office LTSC 2021/2024 and Office 365 for Mac, and Office Online Server running builds below the fixed versions enumerated in ENISA EUVD-2026-99809. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published a vendor fix through its Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97750), which keeps this a high-priority but manageable patch-now item rather than an emergency.
Unauthenticated remote code execution in Microsoft Outlook is reachable when a vulnerable build parses attacker-controlled message content that triggers a double free (CWE-415), allowing the attacker to run code in the context of the Outlook process. Affected builds are Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft Office LTSC 2021 before 16.0.14334.20974, and unpatched Microsoft 365 Apps for Enterprise builds, per the EUVD affected-version data. The static profile is severe (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but no KEV listing, no EPSS value, and no public exploit code were provided; exploitation status is therefore "no public exploit identified at time of analysis," and a vendor patch is available (exact fixed builds known for the LTSC lines, not resolvable for Microsoft 365 Apps from the supplied input).
Heap-based buffer overflow in Microsoft Excel enables remote attackers to execute code on a victim's machine with the privileges of the affected Office process by convincing a user to open or preview a specially crafted workbook (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8). Because the vector shows PR:N, no credentials or elevated privileges are needed, but the UI:R requirement means the bug cannot self-propagate and depends on social engineering to deliver and open the malicious file across Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows, Office LTSC for Mac 2021/2024, Office 365 for Mac, and Office Online Server, all of which have vendor-supplied fixes. Microsoft has published a security update (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97748), and no public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is driven by unpatched, high-exposure Office deployments and phishing-delivered workbooks rather than by an observed campaign.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to execute arbitrary code by convincing a victim to open a maliciously crafted Excel file. This use-after-free vulnerability (CWE-416) affects multiple Excel versions, including Office LTSC 2024, Office LTSC 2021, and Office Online Server, with a CVSS score of 8.8. No public exploit or active exploitation has been identified, and while it is not a zero-click emergency, patching is strongly recommended.
Remote code execution in Microsoft Excel is possible when a user opens a specially crafted spreadsheet, because an integer underflow (CWE-191) in Office's document handling wraps a value and leads to memory corruption exploitable for code execution in the context of the opening user. No authentication is required on the target (PR:N) and the file can be delivered over the network via email, a link, or a shared document, but exploitation depends on the victim opening the file (UI:R), and no server-side or zero-click path is indicated. Microsoft has released fixed builds (for example Office LTSC 2021 16.0.14334.20974 and Office LTSC 2024 16.0.17932.21056), and no public exploit identified at time of analysis; treat this as a high-priority, patch-worthy issue rather than an emergency given the absence of exploitation signals.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code in the context of the current user when a victim opens or previews a specially crafted spreadsheet, making this a genuine high-priority vulnerability for environments running Microsoft Office/Excel. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) shows no credentials or pre-existing privileges are needed, but because user interaction is required (UI:R) and no non-default configuration is involved, exploitation depends on social engineering - typically a phishing attachment, a malicious link, or a web-hosted document - rather than direct remote triggering. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and a vendor patch is available per Microsoft's advisory.
Remote code execution in Microsoft Excel can be triggered by a stack-based buffer overflow when a victim opens a specially crafted workbook, allowing arbitrary code in the context of the opening user. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office for Mac variants, and Office Online Server; the attack is network-deliverable (AV:N) and requires no authentication (PR:N) but depends on user interaction (UI:R) to open the file. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Opening an attacker-crafted Excel workbook in affected Microsoft 365 Apps for Enterprise, Office 365 for Mac, or Office LTSC for Mac builds can trigger a heap-based buffer overflow (CWE-122) that lets an unauthenticated remote attacker execute code in the context of the victim user, earning a CVSS 3.1 base score of 8.8 (High). Delivery is network-based and requires no credentials or special configuration, but the attacker must persuade the victim to open the malicious file (UI:R), so a successful email attachment or download plus user action is sufficient to reach the vulnerability. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the mandatory user-interaction step means Protected View, Mark-of-the-Web blocking, and attachment filtering remain meaningful brakes despite the high base score.
Remote code execution in Microsoft Office Excel is possible when an unauthenticated attacker convinces a user to open a crafted spreadsheet in an unpatched build, with the underlying flaw being an integer underflow/wraparound in the document parser that corrupts memory. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, Office 365 for Mac, and Office Online Server below their fixed builds; exploitation requires the user to open and enable content in the malicious document (CVSS UI:R) but needs no credentials or pre-existing privileges on the target (PR:N). No public exploit was identified at time of analysis, and Microsoft has released fixed builds, so this is a genuine patching priority even though the attack hinges on user interaction and is substantially blunted by Protected View and Mark-of-the-Web sandboxing.
Remote code execution in Microsoft Excel stems from a use-after-free memory corruption flaw (CWE-416) that an unauthenticated attacker can trigger by convincing a victim to open a specially crafted Excel workbook. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, Office 365 for Mac, and Office Online Server, with the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicating low-complexity, network-delivered exploitation that requires no attacker credentials but does require the victim to open the malicious file. Successful exploitation yields code execution in the security context of the user who opened the document, and while no public exploit has been identified at time of analysis, the flaw is vendor-confirmed, rated 8.8, carries an official Microsoft patch, and is considered a credible, actionable priority despite the absence of exploitation telemetry.
Remote code execution in Microsoft Excel allows an unauthorized attacker to run arbitrary code in the context of the user who opens or previews a specially crafted workbook, affecting Microsoft Office LTSC 2021 and 2024, Microsoft 365 Apps for Enterprise, Office for Mac, and Office Online Server. The attack requires user interaction (UI:R) and no authentication (PR:N), with code executing at the user's privilege level rather than elevated; phishing or social engineering is the realistic delivery path. A vendor patch is available, and no public exploit has been identified at time of analysis.
Remote code execution in Microsoft Outlook allows unauthenticated attackers to execute arbitrary code by sending a crafted email that triggers a heap-based buffer overflow when the message is parsed. Affected versions include Microsoft 365 Apps for Enterprise, Office LTSC 2024 before 16.0.17932.21056, and Office LTSC 2021 before 16.0.14334.20974. No public exploit identified at time of analysis, but the vulnerability is high severity (CVSS 9.8) and requires no user interaction per the vendor vector, making it a serious risk for unpatched systems.
Remote code execution in Microsoft Outlook results from a stack-based buffer overflow triggered when a victim opens or previews a maliciously crafted email/message. The flaw affects Microsoft Office LTSC 2021 before 16.0.14334.20974, Microsoft Office LTSC 2024 before 16.0.17932.21056, and Microsoft 365 Apps for Enterprise, with CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) and no privileges required. This is a high-priority issue, though not the absolute top tier of urgency, because user interaction is required; no public exploit identified at time of analysis, and vendor patches are available.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to execute arbitrary code on a victim's system when the user opens a specially crafted Excel document. Affected versions include Microsoft 365 Apps for Enterprise, Office LTSC 2024 and 2021 for Windows and Mac. A vendor patch is available, but no public exploit code has been identified at time of analysis; the mandatory user interaction and Protected View gating make this a patch-priority item rather than an emergency.
Remote code execution in Microsoft Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office Online Server, and the corresponding Mac builds) is possible when an unauthenticated attacker convinces a victim to open a specially crafted Excel workbook. The root cause is a use-after-free (CWE-416) memory-corruption condition that the crafted file triggers inside Excel's parsing/handling logic, giving the attacker code execution in the context of the user, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The decisive limiting factor is mandatory user interaction: there is no zero-click or server-side trigger in the assessed vector, and no public exploit code has been identified at time of analysis. Vendor patches are available, and the MSRC update guide should be treated as the authoritative reference.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthenticated attacker to execute arbitrary code locally when a user opens a specially crafted workbook. The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 before version 16.0.14334.20974, and Microsoft Office LTSC 2024 before version 16.0.17932.21056. Exploitation requires user interaction (UI:R) to open the malicious file; no public exploit identified at time of analysis, and the issue is considered a credible patch-priority item rather than an emergency. Code execution occurs in the context of the user opening the file, so a low-privilege user context limits downstream impact.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code on a victim's machine if the user opens a specially crafted spreadsheet that triggers a buffer underwrite (CWE-124) in Excel's file-parsing path. The flaw carries a CVSS v3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning exploitation is fully remote with no privileges required, but the mandatory user interaction (UI:R) is the key limiting factor - the attack cannot fire unless the malicious workbook is opened, so Protected View, Mark-of-the-Web enforcement and user awareness materially reduce real-world exposure. Affected software covers Microsoft 365 Apps for Enterprise, Office LTSC 2024 and LTSC 2021 on Windows and Mac, and Office Online Server; vendor patches are available per Microsoft's advisory, and no public exploit was identified at time of analysis. By signal convergence this is a genuine high-priority vulnerability, but with no confirmed active exploitation and an interaction prerequisite it is not an emergency.
Heap-based buffer overflow in Microsoft Excel allows unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office Online Server, and Office for Mac. Exploitation requires user interaction (UI:R) and no public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Heap-based buffer overflow in Microsoft Excel allows an unauthenticated remote attacker to execute arbitrary code when a victim opens or previews a crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows and Mac), Office Online Server, and Office 365 for Mac. No public exploit code has been identified at time of analysis, but the CVSS score of 8.8 and low attack complexity make this a credible, actionable priority; vendor patches are available. Code execution occurs in the context of the user who opens the file, and user interaction is required.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to execute arbitrary code in the context of the opening user when a crafted workbook is opened or previewed (user interaction required). Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 for Windows and Mac, Office 365 for Mac, and Office Online Server. No public exploit has been identified at time of analysis, and Microsoft has released patches; risk is high but not a top-tier emergency given the reliance on social engineering.
Heap-based buffer overflow in Microsoft Word allows an unauthenticated attacker to execute arbitrary code in the context of the victim when the victim opens a crafted Word document. The vulnerability affects Microsoft 365 Apps for Enterprise, Office LTSC 2024, Office LTSC 2021, and Office LTSC/365 for Mac 2021/2024. Microsoft has released vendor patches; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. User interaction (opening the document) is the primary limiting factor, and code execution is confined to the user's security context (S:U).
Local privilege escalation in Microsoft OneNote stems from a use-after-free memory corruption flaw (CWE-416) that an authenticated attacker with low-privilege local access can trigger to execute code in a higher-privileged context. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and the corresponding Mac editions. No public exploit has been identified at time of analysis, and vendor patches are available; given the local access prerequisite and patch availability, this is a patch-priority item rather than an emergency.
Opening a specially crafted document in an affected Microsoft Word build triggers a heap-based buffer overflow that lets an attacker execute code in the context of the user who opened the file. Affected builds are Microsoft Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, and Microsoft 365 Apps for Enterprise installations older than the current fixed release. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms the attack requires the victim to open the malicious file, but no attacker credentials or prior privileges are needed; no public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available.
Stack-based buffer overflow in Microsoft Office Word enables a local, authenticated user to elevate privileges to the level of the affected process, resulting in high confidentiality, integrity, and availability impact on the host (CVSS 3.1 base 7.8 HIGH). Affected builds include Microsoft Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, and Office LTSC/365 for Mac. A vendor patch is available; no public exploit code or confirmed active exploitation has been identified at time of analysis.
A security-feature bypass in Microsoft Word allows an attacker-crafted document to subvert an Office security decision when the file is opened on the local machine, rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with high confidentiality, integrity, and availability impact. No privileges or authentication are required, but the attacker depends entirely on convincing the victim to open the malicious document, so delivery is social-engineering based rather than unattended. This is tracked as CWE-807 (reliance on untrusted inputs in a security decision) and EUVD-2026-100189; no public exploit identified at time of analysis, and Microsoft has published a fix (patch available per vendor advisory).
A heap-based buffer overflow in Microsoft PowerPoint allows an unauthenticated attacker to execute arbitrary code in the security context of a user who opens a specially crafted presentation file, with impact rated to confidentiality, integrity, and availability all High. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 for Windows, and Office 365 / Office LTSC 2021 and 2024 for Mac; exploitation requires the victim to open the malicious file (UI:R) delivered out-of-band via email, chat, or web download, and the high attack complexity metric reflects additional attacker-side prerequisites such as winning a specific heap memory layout. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical limits on exploitation remain the required user interaction plus Protected View and Mark-of-the-Web protections applied to files from untrusted sources.
Heap-based buffer overflow in Microsoft Word enables unauthenticated remote attackers to execute arbitrary code if a victim opens a crafted document. The flaw affects Microsoft Office LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Office for Mac; a vendor-released patch is available. No public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as none and automatable as no, reflecting the required user interaction.
Heap-based buffer overflow in Microsoft Office allows unauthenticated remote attackers to execute arbitrary code in the context of the victim user, but only if that user is convinced to open a specially crafted document (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected installations span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and Office LTSC 2021/2024 plus Office 365 for Mac, so both Windows and macOS environments are in scope. No public exploit code or confirmed active exploitation was identified at time of analysis, and the mandatory user interaction (UI:R) - together with Protected View and untrusted-document blocking - is the principal factor limiting real-world exposure; this is a credible prioritization candidate rather than a top-tier emergency on current signals. Microsoft has released vendor patches addressing the flaw.
Remote code execution in Microsoft Office allows an unauthenticated attacker to execute arbitrary code by convincing a user to open a specially crafted document. This heap-based buffer overflow affects Office LTSC 2021 (before 16.0.14334.20974), Office LTSC 2024 (before 16.0.17932.21056), Microsoft 365 Apps for Enterprise, and Mac versions of Office LTSC 2021/2024 and Office 365 for Mac. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation as none, though the vulnerability is high-priority due to total technical impact and network attack vector; patching is available from Microsoft.
Remote code execution in Microsoft Office Word arises from a heap-based buffer overflow that an unauthenticated attacker can trigger by delivering a specially crafted Word document that the victim then opens; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms full compromise of confidentiality, integrity and availability of the user's session, but also confirms that user interaction (UI:R) is the gating precondition. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and Office LTSC/365 for Mac 2021 and 2024, with Windows LTSC fixed versions published as 16.0.14334.20974 (LTSC 2021) and 16.0.17932.21056 (LTSC 2024). No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA SSVC Exploitation: none, Automatable: no), and Microsoft has released patched builds, so this is a credible, actionable remediation priority rather than an emergency-compromise scenario.
Remote code execution in Microsoft Word for Windows and macOS is possible through a heap-based buffer overflow (CWE-122) that is triggered when an affected Office build processes a specially crafted Word document delivered over a network, typically as an email attachment or a web download. The vulnerability is unauthenticated (PR:N) but requires user interaction: the victim must open the malicious document, and the AC:H rating reflects that the attacker must achieve reliable heap layout and grooming to convert the memory corruption into code execution. When successful the outcome is total loss of confidentiality, integrity and availability on the victim's system, although no public exploit code has been identified and CISA's SSVC review records no active exploitation and no automatable path, making this a targeted-attack risk rather than a wormable or mass-exploitation event. Microsoft has released patched builds for the affected Windows and macOS channels.
Remote code execution in Microsoft PowerPoint allows unauthenticated attackers to execute arbitrary code with the privileges of the opening user by delivering a specially crafted presentation that must be opened or rendered. Affected builds include Microsoft Office LTSC 2021 before 16.0.14334.20974, LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, and the macOS Office LTSC 2021/2024 and 365 for Mac editions; vendor patches are available. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none', though the raw CVSS score is 9.8 because successful exploitation yields total confidentiality, integrity, and availability impact.
Remote code execution affects Microsoft Outlook through a stack-based buffer overflow (CWE-121) that a remote attacker can trigger by delivering attacker-controlled content to the victim's Outlook client, with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicating an unauthenticated, no-interaction attack and a maximum impact rating of 9.8 (C:H/I:H/A:H). Impact is total: successful exploitation corrupts stack memory in the Outlook process and can yield code execution in the context of the logged-on user, including full read/write access to mail data and the ability to pivot on the endpoint. No public exploit identified at time of analysis - CISA's SSVC assessment records Exploitation as "none" while rating the attack Automatable (yes) and Technical Impact as total, meaning scalable exploitation is technically feasible once exploit code is developed; patched builds are listed by the vendor for the Windows LTSC lines while several Mac and subscription builds are still tied to pending publication.
Remote code execution in Microsoft Word (part of Microsoft 365 Apps, Office LTSC 2021/2024, and Office for Mac) allows an unauthenticated attacker to execute arbitrary code in the context of a user who opens a crafted document. The vulnerability arises from use of an uninitialized resource (CWE-908) in Word's document parsing; although user interaction is required (UI:R), no privileges are needed on the attacker side (PR:N) and successful exploitation yields high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit code has been identified at time of analysis, but Microsoft has released patches for affected builds.
Remote code execution in Microsoft Excel allows an unauthorized attacker to run arbitrary code on a victim's machine when the target opens a specially crafted workbook, delivered over a network via email attachment, web download, or a shared file. The flaw is a heap-based buffer overflow (CWE-122) in affected Office builds, carrying a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); no authentication or prior access is required, but the attacker is dependent on the victim opening the file, which is why CISA's SSVC assessment rates exploitation as none and the issue as non-automatable. Affected configurations include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024, and the listed macOS Office editions prior to their fixed builds. At time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, so this is a high-priority but not top-of-queue patch item; no EPSS probability was supplied with the source data.
Use-after-free memory corruption in Microsoft PowerPoint enables unauthenticated remote attackers to execute arbitrary code on a victim's machine when a maliciously crafted presentation is opened. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms no authentication is required, but exploitation depends on the target opening the attacker-supplied file, making email attachments, chat-delivered documents, and shared links the practical delivery vectors. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and the macOS Office SKUs; the vendor has released updates, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Microsoft Office Click-To-Run allows an attacker who already holds a low-privileged foothold on a Windows host to turn a use-after-free (CWE-416) memory-corruption flaw into full compromise of the affected process context, rated CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with high confidentiality, integrity and availability impact and no user interaction required. The affected deployments are Microsoft Office installed and serviced through Click-To-Run: Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. Because the vector is AV:L/PR:L, this is an authenticated, post-access escalation primitive rather than a remote or unauthenticated attack path, and no public exploit code or confirmed active exploitation was identified at the time of analysis; Microsoft has released patched builds. The practical risk is bounded by the prerequisite initial foothold, and reliable exploitation additionally depends on winning the heap reuse/grooming required to control the freed object.
Local privilege escalation in Microsoft Office Click-To-Run allows an authenticated low-privileged attacker who already has code execution on a target host to trigger a use-after-free (CWE-416) and gain elevated privileges. The flaw affects Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 installations, requires no user interaction, and has no remote attack surface; no public exploit has been identified at time of analysis. CISA SSVC rates exploitation as none and automatable as no, and vendor patches are available.
Stack-based buffer overflow in Microsoft Word affects Office LTSC 2021, Office LTSC 2024, Microsoft 365 Apps for Enterprise, and the Mac editions of Office, allowing a remote attacker to execute code in the context of the victim who opens a specially crafted Word document (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No attacker privileges are required, but exploitation depends on user interaction - typically an email attachment or a web-downloaded document - which is the primary limiting factor and is why CISA's SSVC assessment records Exploitation: none and Automatable: no. Microsoft has released vendor patches and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Excel allows unauthenticated remote attackers to execute arbitrary code when a victim opens a specially crafted Excel document, affecting Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, Microsoft 365 Apps for Enterprise, and corresponding Mac editions. Exploitation requires user interaction (opening a malicious file) and no public exploit or active exploitation is currently identified, per SSVC (Exploitation: none). Vendor patches are available, and code execution occurs only with the privileges of the user who opens the file.
Heap-based buffer overflow in Microsoft Word lets an unauthenticated remote attacker execute arbitrary code in the context of the user who opens a specially crafted document, affecting Office LTSC 2021 and LTSC 2024, Microsoft 365 Apps for Enterprise, and the Office LTSC/365 for Mac channels. Because the flaw triggers only when the victim opens the malicious file (CVSS UI:R) and SSVC marks it non-automatable, exploitation depends on social engineering rather than automated mass attacks, even though a successful hit yields total loss of confidentiality, integrity and availability (CVSS 8.8). A vendor patch is available; no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow in Microsoft Word allows remote code execution when a user opens or previews a specially crafted document. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 on Windows, and Office LTSC for Mac 2021/2024 plus Office 365 for Mac, with a CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and total technical impact per CISA's SSVC. Exploitation requires the victim to open the malicious document (UI:R), so it is not reachable through passive network traffic or automated scanning, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; vendor patches are available and should be prioritized given the high impact.
Remote code execution in Microsoft Office Word is possible when a crafted document exploits an untrusted pointer dereference (CWE-822), letting an attacker run arbitrary code with the privileges of the user who opens the file. Affected builds are Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and Microsoft 365 Apps for Enterprise (channel-based, fix delivered through the Microsoft Office security release channel). The input rates this 9.8 with a UI:N vector, but the independent assessment resolves user interaction as required (UI:R) because the victim must open - or conceivably preview - the malicious Word document, and no authentication is required of the attacker (PR:N); that interaction requirement materially lowers real-world risk below what a 9.8 no-interaction score implies, and there is no public exploit identified at time of analysis (CISA SSVC records Exploitation: none, and KEV/PoC signals are absent). Microsoft has released vendor patches, so the exposure window is bounded by patching cadence.
Heap-based buffer overflow in Microsoft Outlook allows an unauthenticated remote attacker to execute code over a network by delivering a crafted email message that Outlook processes during parsing or rendering. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) asserts no privileges and no user interaction, implying a zero-click/preview-pane trigger against default configurations; the impact is scoped to installations running the vulnerable builds of Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 365 for Mac, and Office LTSC for Mac 2021/2024. CISA's SSVC assessment reports Exploitation: none and no public exploit code has been identified at time of analysis, but the issue is rated Automatable: yes with Technical Impact: total, and a vendor patch is available - this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-real-risk case.
Heap-based buffer overflow in Microsoft Word allows remote attackers to execute code in the context of the user who opens a crafted Word document. Exploitation requires the victim to open an attacker-supplied file (CVSS UI:R) and no authentication or prior privileges (PR:N), with code running only in the opening user's context and no privilege escalation (S:U); SSVC marks the attack non-automatable, and no public exploit has been identified at time of analysis. Vendor patches are available, including fixed builds for Office LTSC 2021 and LTSC 2024, with updates for Mac and Microsoft 365 Apps distributed through Microsoft's Office security release channel.
Heap-based buffer overflow in Microsoft Office Outlook (CWE-122) lets a remote, unauthenticated attacker execute arbitrary code in the context of the Outlook process by delivering a specially crafted message or object that the victim must open or render. Affected builds per EUVD-2026-99711 are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 below 16.0.14334.20974, and Microsoft Office LTSC 2024 below 16.0.17932.21056; CVSS 3.1 is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with the mandatory user interaction being the only meaningful barrier. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, and SSVC records Exploitation=none with Automatable=no, so this is a credible mid-to-high priority client-side issue rather than an emergency; no EPSS score was supplied in the feed, so no probabilistic exploitation estimate can be cited.
An out-of-bounds read in Microsoft Outlook allows an unauthenticated, remote attacker to disclose information by getting crafted content parsed or rendered by the Outlook client, rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) by the vendor with confidentiality-only impact. Our independent assessment keeps the network vector and high confidentiality impact but conservatively scores user interaction as required (UI:R), because the crafted message or attachment must actually reach a mailbox and be opened or previewed by Outlook - a delivery-and-render precondition, not a directly reachable network service. No public exploit code has been identified at time of analysis (CISA SSVC rates exploitation as 'none' and the issue is not in KEV), and a vendor patch is available, placing this in the important-but-not-emergency tier.
Local privilege escalation in Microsoft Office Click-To-Run arises from a use-after-free memory corruption flaw that lets an attacker who already holds low-privileged local access on a Windows host elevate to higher integrity, with high impact to confidentiality, integrity, and availability. Affected installations include Microsoft 365 Apps for Enterprise (16.0.1 branch), Microsoft Office LTSC 2021 below 16.0.14334.20974, and Microsoft Office LTSC 2024 below 16.0.17932.21056; the attack is local-only (AV:L), requires authenticated low-privileged code execution (PR:L), needs no user interaction (UI:N), and carries high attack complexity (AC:H) because of the heap-state/race conditions inherent to reliable use-after-free exploitation. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', so this is a moderate-to-high priority patching item rather than an emergency; a vendor patch is available.
Heap-based buffer overflow in Microsoft Word allows unauthenticated remote attackers to execute arbitrary code when a crafted document is parsed, though exploitation is difficult to trigger reliably (AC:H) and, per our assessment, requires the victim to open or preview the malicious file (UI:R). Microsoft's advisory vector lists UI:N (no user interaction), which would suggest an automatic preview-pane path; this discrepancy should be resolved with MSRC because UI:R materially lowers real-world exploitability. A vendor patch is available for all affected Office channels, no public exploit code or CISA KEV entry was identified at time of analysis, and SSVC marks the flaw non-automatable, making this a serious but not emergency-tier vulnerability.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and corresponding Office for Mac editions when a victim opens a specially crafted document that triggers a heap-based buffer overflow. The attacker is unauthenticated (PR:N), but exploitation requires user interaction (UI:R), and any code runs in the context of the opening user (S:U) without crossing a privilege boundary. Microsoft has released patches; no public exploit identified at time of analysis, so treat this as a high-priority phishing-borne update item rather than a remotely triggerable no-interaction emergency.
Heap-based buffer overflow in Microsoft Outlook lets an unauthenticated remote attacker execute arbitrary code in the context of the user who opens or previews a specially crafted email or attachment, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2024 before 16.0.17932.21056, and Office LTSC 2021 before 16.0.14334.20974. Exploitation is gated by mandatory victim interaction (UI:R) and code runs at the interacting user's privilege level rather than SYSTEM (S:U), so it is a high-priority but not emergency-level issue. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as none with total technical impact; vendor-released patches are available. Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (CVSS 8.8); CWE-122; EUVD-2026-99710.
Heap-based buffer overflow in Microsoft Outlook allows remote code execution in the context of the logged-on user when a victim opens or renders a specially crafted email item. Affected builds are Microsoft 365 Apps for Enterprise and Microsoft Office LTSC 2024 prior to 16.0.17932.21056; the flaw is network-reachable and requires no authentication on the target (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, rated 8.8, CWE-122). CISA's SSVC assessment records no observed exploitation and non-automatable delivery, and no public exploit code has been identified at time of analysis, so this is a credible high-priority patching item rather than a confirmed emergency - mitigated in practice by mandatory user interaction and user-level (non-admin) execution context.
Remote code execution in Microsoft Excel (CVSS 8.8) becomes possible when an unauthenticated attacker convinces a victim to open a specially crafted spreadsheet, triggering an out-of-bounds read (CWE-125) that can be turned into memory corruption and code execution in the context of the user who opened the file. Affected configurations include Microsoft Office LTSC 2021 below 16.0.14334.20974, Microsoft Office LTSC 2024 below 16.0.17932.21056, Microsoft 365 Apps for Enterprise, and Office 365 for Mac. No public exploit has been identified at time of analysis, CISA's SSVC decision framework records exploitation as none and the issue as not automatable, and vendor-released patches are available, making this a high-priority patch target rather than an emergency.
Heap-based buffer overflow in Microsoft Outlook lets an unauthenticated remote attacker execute arbitrary code by getting a crafted message processed by a vulnerable client, with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWE-122 as the root-cause class. Affected builds are Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft Office LTSC 2021 before 16.0.14334.20974, and unpatched Microsoft 365 Apps for Enterprise channels; because the assessed vector carries PR:N/UI:N, delivery of a malicious message to the mailbox is sufficient under default configurations, with patch state as the main limiting factor. Vendor-released patch: available from Microsoft per the MSRC update guide; there is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' while flagging the flaw as automatable with total technical impact.
Code execution in Microsoft Word is possible when a user opens a specially crafted document that triggers a heap-based buffer overflow (CWE-122) in the application's document parsing logic. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): exploitation is unauthenticated and needs no elevated privileges, but it is local in nature and requires the victim to open a malicious file, meaning an attacker must first succeed at social engineering - the SSVC assessment records Exploitation=none, Automatable=no, and there is no public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) activity. Successful exploitation yields arbitrary code only in the security context of the user who opened the document, not inherently SYSTEM or administrator, so the practical risk is a workstation-level compromise rather than immediate full host takeover.
Remote code execution in Microsoft PowerPoint stems from a use-after-free memory corruption flaw (CWE-416) that an unauthenticated remote attacker can trigger by delivering a maliciously crafted PowerPoint/Office document to a victim, who must then open it (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and the macOS Microsoft 365/Office LTSC releases identified in EUVD-2026-100169. CISA SSVC records exploitation as 'none' and automatable as 'no', so no public exploit identified at time of analysis, and Microsoft has published fixed versions through the MSRC update guide.
Out-of-bounds read in Microsoft Excel allows a remote, unauthenticated attacker to execute arbitrary code when a victim opens a maliciously crafted spreadsheet. The vulnerability requires user interaction (CVSS UI:R) and stems from improper input validation (CWE-20); successful exploitation can fully compromise confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, but the high CVSS score (8.8) and the lack of a confirmed fixed version in the provided data make this a high-priority patching item.
Heap-based buffer overflow in Microsoft Access lets an attacker execute arbitrary code at the privilege level of a user who opens a specially crafted Access database file, scoring CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No credentials or target-side configuration are needed, but the attack chain depends on the victim opening or interacting with the malicious file (UI:R), making file delivery and social engineering the main barrier; Microsoft has published a fix via its update-guide advisory. There is no CISA KEV entry and no public exploit identified at time of analysis, though the high impact across confidentiality, integrity and availability makes prompt patching a genuine priority.
Heap-based buffer overflow in Microsoft Office Access allows remote code execution when a victim opens a malicious, attacker-crafted Access file such as an .accdb or .mdb database or an embedded object. Affected users are those with Access installed on the target host: no authentication to the system is required (PR:N) and attack complexity is low (AC:L), but exploitation is gated by the mandatory victim interaction (UI:R) of opening the crafted file, and any code executes only with the opening user's privileges (S:U). No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the MSRC advisory is the authoritative reference, and CVSS 8.8 reflects high confidentiality, integrity, and availability impact, making this a credible operational priority rather than a drop-everything emergency.
Integer overflow (CWE-190) in Microsoft Word's document parsing can allow an unauthenticated, network-delivered attacker to execute code in the context of the victim by convincing them to open a specially crafted Word document. Exploitation requires user interaction (UI:R) and high attack complexity (AC:H), and impact is confined to the user's Word process (scope unchanged). No public exploit identified at time of analysis, making this a moderately high but not top-tier priority for most organizations.
Heap-based buffer overflow in Microsoft Access enables unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted database file. Exploitation is non-trivial due to high attack complexity (AC:H) and requires user interaction (UI:R), but successful exploitation grants code execution with the user's privileges. No public exploit code has been identified at time of analysis, and a vendor patch is available via the Microsoft Security Response Center.
Heap-based buffer overflow in Microsoft PowerPoint allows unauthenticated remote attackers to execute arbitrary code when a victim opens a specially crafted presentation file, but exploitation requires user interaction and reliable heap corruption against modern memory-safety mitigations (AC:H). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is considered moderate-to-high due to the social engineering delivery and Protected View defenses that can impede successful attacks. This vulnerability affects Microsoft Office PowerPoint installations that have not received the update referenced in the Microsoft Security Update Guide.
Command injection in Microsoft OneNote allows an unauthenticated remote attacker to execute code when a victim opens a specially crafted OneNote document. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and affects Microsoft 365 Apps for Enterprise 16.0.1 per EUVD, with user interaction being the primary exploitation barrier. No public exploit was identified at time of analysis, and Microsoft has published an advisory and update path via the MSRC update guide.
Heap-based buffer overflow in Microsoft Office Excel lets an unauthenticated remote attacker execute arbitrary code on a target system when the victim opens or previews a specially crafted spreadsheet, as described in Microsoft's MSRC update guide. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms no privileges or credentials are needed, but the required user interaction makes phishing delivery of the malicious file the practical attack path, with any code running at the privilege level of the user who opens it. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024, Office for Mac (365/2021/2024), and Office Online Server, so this is a broad default-installation exposure; no public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published an update so patching is the decisive control.
Remote code execution in Microsoft Excel occurs when a user opens an attacker-crafted spreadsheet, exploiting an integer overflow (wraparound) that corrupts memory while Excel processes the file. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): the attacker needs no credentials and can deliver the file over the network, but successful exploitation hinges on the victim opening the document, so real-world attacks depend on social engineering or malicious file delivery rather than autonomous remote compromise. Affected builds include Office LTSC 2021 and 2024, Office Online Server, the Mac LTSC and 365 editions, and Microsoft 365 Apps for Enterprise; this is a genuine high-priority vulnerability, though there is no public exploit identified at time of analysis, and a vendor patch is available.
Heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code in the security context of the current user when a victim opens an attacker-supplied workbook, rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No authentication or prior privileges are required, but exploitation is gated by user interaction - the attacker must deliver a malicious Excel file (typically by email, link, or download) and persuade the target to open or preview it, so the AV:N vector reflects file delivery over the network rather than a directly reachable network service. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and Microsoft has shipped patched builds for the Windows Office and Office Online Server editions while macOS fixes remain pending publication.
Remote code execution in Microsoft Excel is possible via a heap-based buffer overflow that an unauthenticated attacker can trigger by convincing a targeted user to open a specially crafted workbook (UI:R), with code running in the context of that user. No public exploit code was identified at time of analysis, and the required user interaction - typically a phishing attachment, web-hosted document, or file-share lure - is the primary limiting factor on practical exploitation. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2024 and LTSC 2021, Office LTSC/365 for Mac, and Office Online Server, making this a genuine patch-priority item for environments still on vulnerable builds.
Opening or previewing an attacker-supplied Excel spreadsheet can allow a remote, unauthenticated attacker to run code in the security context of the user who opened the file on affected Windows and macOS Office builds (Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and the corresponding Mac editions). The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so while delivery is remote via email or web, exploitation is gated by user interaction - the victim must open the crafted document - and the resulting impact is bounded by that user's privileges. No public exploit code has been identified at time of analysis and the vendor has released patches, so this is a patching-priority item rather than a confirmed actively exploited or wormable remote flaw.
Local privilege escalation in Microsoft Office Click-To-Run (C2R) arises from a time-of-check time-of-use race condition in the installer/updater's file handling, letting an authorized low-privileged local user substitute attacker-controlled content in the window between validation and use and thereby gain higher privileges on the host. The flaw is rated CVSS 3.1 base 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it is strictly local, requires a pre-existing authenticated session, needs no victim interaction, but is timing-dependent and therefore probabilistic - repeated attempts may be needed to win the race. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so this is a privilege-escalation primitive for an attacker who already holds a local foothold rather than a remotely reachable or actively exploited issue. Deployments affected are Microsoft 365 Apps for Enterprise installed via Click-To-Run (reported as version 16.0.1).
Heap-based buffer overflow in Microsoft Excel enables remote, unauthenticated attackers to execute arbitrary code in the context of the logged-on user when the victim opens a maliciously crafted Excel document. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R vector, no credentials or prior access are required and attack complexity is low, with the only meaningful barrier being the mandatory user interaction of opening the file; Microsoft rates this 8.8 High, and a vendor patch is available from Microsoft (MSRC update guide for CVE-2026-97773). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the broad install base of Microsoft 365 Apps and Office LTSC makes prompt patching important. This is a credible high-priority issue.
Remote code execution in Microsoft Excel affects Office LTSC 2021, LTSC 2024, Office Online Server, Microsoft 365 Apps, and Mac editions when a victim opens a specially crafted spreadsheet (UI:R). An unauthenticated attacker (PR:N) can trigger a double free (CWE-415) to corrupt memory and execute code in the context of the user; no public exploit has been identified. Although high severity (CVSS 8.8), exploitation requires user interaction and is not zero-click, and vendor patches are available.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code on a victim's machine when the victim opens a maliciously crafted spreadsheet, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 (Windows and Mac), Office Online Server, and Office 365 for Mac. The defect is a use-after-free memory-corruption issue (CWE-416) rated CVSS 8.8 with full impact to confidentiality, integrity, and availability, but exploitation hinges on the user-interaction prerequisite (CVSS UI:R) of opening the file - it is not a remote code path that fires without a user action. No public exploit code has been identified and there is no CISA KEV confirmation of active exploitation at time of analysis; vendor patches are available, so this is a high-priority but not currently urgent-tier issue given the absence of exploitation signals.
Stack-based buffer overflow in Microsoft Excel allows an unauthenticated remote attacker to execute arbitrary code in the context of the user who opens or previews a specially crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, corresponding Mac editions, and Office Online Server; exploitation requires user interaction (UI:R), and no public exploit was identified at time of analysis. Vendor patches are available, with fixed builds such as 16.0.17932.21056 for Office LTSC 2024.
Heap-based buffer overflow in Microsoft Office Excel lets a remote, unauthenticated attacker execute code when a victim opens or previews a specially crafted Excel workbook in an affected Office build. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/SU/C:H/I:H/A:H means the attacker needs the user to interact with the malicious file, not a server-side or fully unauthenticated service exploit, despite the network attack-vector label. Microsoft has released patches per the MSRC advisory; no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code in the context of the user who opens a specially crafted spreadsheet. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), no authentication or prior privileges are required, but exploitation is conditional on the victim opening the malicious file - there is no zero-click path, which is the defining prerequisite and the primary limiting factor. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021 (Windows and Mac), Office LTSC/365 for Mac, and Office Online Server; there is no public exploit identified at time of analysis, and no CISA KEV listing, though Microsoft has published a vendor fix.
Arbitrary code execution in Microsoft Office Excel is possible when a user opens a specially crafted workbook, because the parser mishandles memory and triggers a double free (CWE-415). The flaw is remotely deliverable by an unauthenticated attacker (CVSS 3.1 AV:N/AC:L/PR:N), but exploitation depends on the victim opening the malicious file (UI:R), limiting the attack to social-engineering delivery; successful exploitation runs code with the privileges of the opening user. Affected software includes Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office for Mac builds, and Office Online Server builds below the fixed versions, and a vendor patch is available; no public exploit code or confirmed active exploitation was identified at the time of analysis.
Heap-based buffer overflow in Microsoft Excel allows remote code execution when a victim opens an attacker-crafted spreadsheet in a vulnerable build, including Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office for Mac, and Office Online Server. The attack is unauthenticated from the attacker's side but requires user interaction (UI:R), meaning the target must open or preview the file, after which code executes in that user's security context. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV, though vendor patches are available and should be treated as a high-priority patch item.
Code execution in Microsoft Excel is possible when an unauthenticated remote attacker convinces a user to open a specially crafted workbook, triggering a heap-based buffer overflow (CWE-122) that can corrupt memory and allow arbitrary code to run in the context of the application. The flaw affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office Online Server, and the listed Mac LTSC/365 builds, with exploitation requiring user interaction to open the document (UI:R). Microsoft has released patched versions for the Windows and server builds, and no public exploit identified at time of analysis.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to compromise affected systems when a victim opens or previews a maliciously crafted workbook. This heap-based buffer overflow affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows and Mac), Office 365 for Mac, and Office Online Server; a vendor patch is available. No public exploit code has been identified at time of analysis, and while exploitation requires user interaction, the vulnerability is high priority but not an emergency 'patch-tonight' situation.
Remote code execution in Microsoft Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows and Mac, Office 365 for Mac, and Office Online Server) allows an unauthenticated remote attacker to execute code with the victim's privileges by convincing them to open or preview a specially crafted workbook. The flaw is an out-of-bounds write (CWE-787) triggered during file parsing, and exploitation hinges on the required user interaction (CVSS UI:R); no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. Microsoft has released patches-Office LTSC 2024 16.0.17932.21056, Office LTSC 2021 16.0.14334.20974, and Office Online Server 16.0.10417.20228-making this a genuine patch-priority item but not a drop-everything emergency.
Stack-based buffer overflow in the Excel document parser allows a remote, unauthenticated attacker to execute code in the context of the current user when a victim opens a maliciously crafted spreadsheet. Exploitation requires user interaction (UI:R) - the file must be opened - and the attacker gains no elevated privileges, with code running locally rather than as SYSTEM or root, though impact to confidentiality, integrity and availability is rated high for that user context. The flaw affects Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and Office LTSC for Mac 2021/2024, and a vendor patch is available; no public exploit code was identified at time of analysis and exploitation has not been confirmed as active (no CISA KEV listing), so risk is driven by the large Office install base and the ease of delivering a file by email or web rather than by observed attacks.
Memory corruption in Microsoft Excel lets a remote, unauthenticated attacker execute code in the context of the user who opens a specially crafted spreadsheet. The flaw is a use-after-free (CWE-416) triggered while Excel parses the malicious document, and it affects Microsoft 365 Apps for Enterprise, Office LTSC 2024 and 2021 on Windows, and Office/Office LTSC for Mac 2021 and 2024. The decisive limiting factor is the required user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8): there is no zero-click or server-side path, so exploitation depends on social engineering to get a victim to open the file; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied. This makes it a genuine high-priority patch item rather than a drop-everything emergency.
Heap-based buffer overflow in Microsoft Excel enables remote code execution when a user opens or previews a specially crafted spreadsheet, rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R). Any affected build - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office LTSC for Mac 2021/2024, Microsoft Office 365 for Mac, or Office Online Server - that processes the malicious file is at risk; no authentication or non-default configuration is required, but the attacker must convince the victim to open the document. No public exploit identified at time of analysis, and the flaw is not confirmed as actively exploited, though the high confidentiality, integrity, and availability impact makes it a priority patch for Office endpoints.
Heap-based buffer overflow in Microsoft Office Excel allows unauthenticated remote attackers to execute code by convincing a user to open a specially crafted Excel file. Exploitation requires user interaction and can be blocked by Protected View, but the high impact (CVSS 8.8) makes patching a high priority even though no public exploit has been identified at the time of analysis.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code in the context of a victim user by convincing them to open a crafted spreadsheet that triggers a heap-based buffer overflow (CWE-122). CVSS 3.1 rates this 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), confirming no attacker credentials are needed but requiring user interaction (opening the file, typically via phishing or a malicious download); the code executes with the victim's privileges, so a low-privileged account limits the immediate impact. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 and LTSC for Mac, Office 365 for Mac, and Office Online Server below patched versions like 16.0.14334.20974, 16.0.17932.21056, and 16.0.10417.20228, and no public exploit or KEV listing is confirmed at time of analysis.
Out-of-bounds read in Microsoft Excel enables remote code execution (CVSS 8.8) when a user opens or previews a specially crafted workbook, requiring user interaction (UI:R) but no attacker authentication (PR:N). Affected products include Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365/LTSC for Mac, Office Online Server, and SharePoint Server Subscription Edition builds prior to vendor-fixed versions, so server-side document rendering can broaden exposure. No public exploit identified at time of analysis, and vendor patches are available; the primary limiting factor is the required user action.
Heap-based buffer overflow in Microsoft Excel allows unauthenticated attackers to execute arbitrary code in the context of the user who opens a maliciously crafted workbook, with the file delivered over the network (CVSS:3.1/AV:N/AC:L/PR:N/UI:R). Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office Online Server, and Office LTSC for Mac; no public exploit identified at time of analysis, and vendor patches remove the condition.
Remote code execution in Microsoft Excel is possible when a user opens a specially crafted workbook, driven by a heap-based buffer overflow. Affected versions include Microsoft Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Office Online Server before 16.0.10417.20228, Microsoft 365 Apps for Enterprise, and the listed macOS Office builds; the CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No public exploit was identified at time of analysis and no CISA KEV entry is provided, but the mandatory user interaction makes social engineering the practical attack path, and vendor patches are available.
Use-after-free in Microsoft Excel enables remote code execution when a victim opens an attacker-crafted workbook; the attacker needs no authentication (PR:N) but must convince the user to open the file (UI:R), as reflected in the assessed CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Successful exploitation runs code in the context of the opening user with high confidentiality, integrity, and availability impact, and default Excel configurations on the listed builds are affected. Vendor patches are available with specific fix builds (e.g., 16.0.14334.20974 for Office LTSC 2021, 16.0.17932.21056 for Office LTSC 2024, and 16.0.10417.20228 for Office Online Server), and no public exploit code was identified at time of analysis, making this a genuine high-priority patch-worthy issue but not an emergency at the time of analysis.
Heap-based buffer overflow in Microsoft Excel (CWE-122) lets an unauthenticated attacker execute arbitrary code in the context of the victim's user account when that user opens a specially crafted spreadsheet; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) reflects full confidentiality, integrity and availability impact but is gated by mandatory user interaction. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 on Windows and Mac, Office 365 for Mac, and Office Online Server, so both endpoint document handling and server-side file rendering are in scope. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but with a vendor patch already published it is a high-priority patching candidate for environments that routinely open externally sourced Office files rather than a drop-everything emergency.
Stack-based buffer overflow in Microsoft Excel enables remote code execution against affected builds when a victim opens an attacker-crafted spreadsheet; the memory-corruption flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so no credentials or prior access are needed, but successful exploitation hinges entirely on the target user opening the malicious document. Exposure spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 on Windows, Office LTSC 2021/2024 and Office 365 for Mac, and Office Online Server running builds below the fixed versions enumerated in ENISA EUVD-2026-99809. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published a vendor fix through its Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97750), which keeps this a high-priority but manageable patch-now item rather than an emergency.
Unauthenticated remote code execution in Microsoft Outlook is reachable when a vulnerable build parses attacker-controlled message content that triggers a double free (CWE-415), allowing the attacker to run code in the context of the Outlook process. Affected builds are Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft Office LTSC 2021 before 16.0.14334.20974, and unpatched Microsoft 365 Apps for Enterprise builds, per the EUVD affected-version data. The static profile is severe (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but no KEV listing, no EPSS value, and no public exploit code were provided; exploitation status is therefore "no public exploit identified at time of analysis," and a vendor patch is available (exact fixed builds known for the LTSC lines, not resolvable for Microsoft 365 Apps from the supplied input).
Heap-based buffer overflow in Microsoft Excel enables remote attackers to execute code on a victim's machine with the privileges of the affected Office process by convincing a user to open or preview a specially crafted workbook (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8). Because the vector shows PR:N, no credentials or elevated privileges are needed, but the UI:R requirement means the bug cannot self-propagate and depends on social engineering to deliver and open the malicious file across Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows, Office LTSC for Mac 2021/2024, Office 365 for Mac, and Office Online Server, all of which have vendor-supplied fixes. Microsoft has published a security update (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97748), and no public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is driven by unpatched, high-exposure Office deployments and phishing-delivered workbooks rather than by an observed campaign.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to execute arbitrary code by convincing a victim to open a maliciously crafted Excel file. This use-after-free vulnerability (CWE-416) affects multiple Excel versions, including Office LTSC 2024, Office LTSC 2021, and Office Online Server, with a CVSS score of 8.8. No public exploit or active exploitation has been identified, and while it is not a zero-click emergency, patching is strongly recommended.
Remote code execution in Microsoft Excel is possible when a user opens a specially crafted spreadsheet, because an integer underflow (CWE-191) in Office's document handling wraps a value and leads to memory corruption exploitable for code execution in the context of the opening user. No authentication is required on the target (PR:N) and the file can be delivered over the network via email, a link, or a shared document, but exploitation depends on the victim opening the file (UI:R), and no server-side or zero-click path is indicated. Microsoft has released fixed builds (for example Office LTSC 2021 16.0.14334.20974 and Office LTSC 2024 16.0.17932.21056), and no public exploit identified at time of analysis; treat this as a high-priority, patch-worthy issue rather than an emergency given the absence of exploitation signals.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code in the context of the current user when a victim opens or previews a specially crafted spreadsheet, making this a genuine high-priority vulnerability for environments running Microsoft Office/Excel. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) shows no credentials or pre-existing privileges are needed, but because user interaction is required (UI:R) and no non-default configuration is involved, exploitation depends on social engineering - typically a phishing attachment, a malicious link, or a web-hosted document - rather than direct remote triggering. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and a vendor patch is available per Microsoft's advisory.
Remote code execution in Microsoft Excel can be triggered by a stack-based buffer overflow when a victim opens a specially crafted workbook, allowing arbitrary code in the context of the opening user. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office for Mac variants, and Office Online Server; the attack is network-deliverable (AV:N) and requires no authentication (PR:N) but depends on user interaction (UI:R) to open the file. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Opening an attacker-crafted Excel workbook in affected Microsoft 365 Apps for Enterprise, Office 365 for Mac, or Office LTSC for Mac builds can trigger a heap-based buffer overflow (CWE-122) that lets an unauthenticated remote attacker execute code in the context of the victim user, earning a CVSS 3.1 base score of 8.8 (High). Delivery is network-based and requires no credentials or special configuration, but the attacker must persuade the victim to open the malicious file (UI:R), so a successful email attachment or download plus user action is sufficient to reach the vulnerability. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the mandatory user-interaction step means Protected View, Mark-of-the-Web blocking, and attachment filtering remain meaningful brakes despite the high base score.
Remote code execution in Microsoft Office Excel is possible when an unauthenticated attacker convinces a user to open a crafted spreadsheet in an unpatched build, with the underlying flaw being an integer underflow/wraparound in the document parser that corrupts memory. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, Office 365 for Mac, and Office Online Server below their fixed builds; exploitation requires the user to open and enable content in the malicious document (CVSS UI:R) but needs no credentials or pre-existing privileges on the target (PR:N). No public exploit was identified at time of analysis, and Microsoft has released fixed builds, so this is a genuine patching priority even though the attack hinges on user interaction and is substantially blunted by Protected View and Mark-of-the-Web sandboxing.
Remote code execution in Microsoft Excel stems from a use-after-free memory corruption flaw (CWE-416) that an unauthenticated attacker can trigger by convincing a victim to open a specially crafted Excel workbook. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, Office 365 for Mac, and Office Online Server, with the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicating low-complexity, network-delivered exploitation that requires no attacker credentials but does require the victim to open the malicious file. Successful exploitation yields code execution in the security context of the user who opened the document, and while no public exploit has been identified at time of analysis, the flaw is vendor-confirmed, rated 8.8, carries an official Microsoft patch, and is considered a credible, actionable priority despite the absence of exploitation telemetry.
Remote code execution in Microsoft Excel allows an unauthorized attacker to run arbitrary code in the context of the user who opens or previews a specially crafted workbook, affecting Microsoft Office LTSC 2021 and 2024, Microsoft 365 Apps for Enterprise, Office for Mac, and Office Online Server. The attack requires user interaction (UI:R) and no authentication (PR:N), with code executing at the user's privilege level rather than elevated; phishing or social engineering is the realistic delivery path. A vendor patch is available, and no public exploit has been identified at time of analysis.
Remote code execution in Microsoft Outlook allows unauthenticated attackers to execute arbitrary code by sending a crafted email that triggers a heap-based buffer overflow when the message is parsed. Affected versions include Microsoft 365 Apps for Enterprise, Office LTSC 2024 before 16.0.17932.21056, and Office LTSC 2021 before 16.0.14334.20974. No public exploit identified at time of analysis, but the vulnerability is high severity (CVSS 9.8) and requires no user interaction per the vendor vector, making it a serious risk for unpatched systems.
Remote code execution in Microsoft Outlook results from a stack-based buffer overflow triggered when a victim opens or previews a maliciously crafted email/message. The flaw affects Microsoft Office LTSC 2021 before 16.0.14334.20974, Microsoft Office LTSC 2024 before 16.0.17932.21056, and Microsoft 365 Apps for Enterprise, with CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) and no privileges required. This is a high-priority issue, though not the absolute top tier of urgency, because user interaction is required; no public exploit identified at time of analysis, and vendor patches are available.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to execute arbitrary code on a victim's system when the user opens a specially crafted Excel document. Affected versions include Microsoft 365 Apps for Enterprise, Office LTSC 2024 and 2021 for Windows and Mac. A vendor patch is available, but no public exploit code has been identified at time of analysis; the mandatory user interaction and Protected View gating make this a patch-priority item rather than an emergency.
Remote code execution in Microsoft Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office Online Server, and the corresponding Mac builds) is possible when an unauthenticated attacker convinces a victim to open a specially crafted Excel workbook. The root cause is a use-after-free (CWE-416) memory-corruption condition that the crafted file triggers inside Excel's parsing/handling logic, giving the attacker code execution in the context of the user, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The decisive limiting factor is mandatory user interaction: there is no zero-click or server-side trigger in the assessed vector, and no public exploit code has been identified at time of analysis. Vendor patches are available, and the MSRC update guide should be treated as the authoritative reference.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthenticated attacker to execute arbitrary code locally when a user opens a specially crafted workbook. The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 before version 16.0.14334.20974, and Microsoft Office LTSC 2024 before version 16.0.17932.21056. Exploitation requires user interaction (UI:R) to open the malicious file; no public exploit identified at time of analysis, and the issue is considered a credible patch-priority item rather than an emergency. Code execution occurs in the context of the user opening the file, so a low-privilege user context limits downstream impact.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code on a victim's machine if the user opens a specially crafted spreadsheet that triggers a buffer underwrite (CWE-124) in Excel's file-parsing path. The flaw carries a CVSS v3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning exploitation is fully remote with no privileges required, but the mandatory user interaction (UI:R) is the key limiting factor - the attack cannot fire unless the malicious workbook is opened, so Protected View, Mark-of-the-Web enforcement and user awareness materially reduce real-world exposure. Affected software covers Microsoft 365 Apps for Enterprise, Office LTSC 2024 and LTSC 2021 on Windows and Mac, and Office Online Server; vendor patches are available per Microsoft's advisory, and no public exploit was identified at time of analysis. By signal convergence this is a genuine high-priority vulnerability, but with no confirmed active exploitation and an interaction prerequisite it is not an emergency.
Heap-based buffer overflow in Microsoft Excel allows unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office Online Server, and Office for Mac. Exploitation requires user interaction (UI:R) and no public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Heap-based buffer overflow in Microsoft Excel allows an unauthenticated remote attacker to execute arbitrary code when a victim opens or previews a crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows and Mac), Office Online Server, and Office 365 for Mac. No public exploit code has been identified at time of analysis, but the CVSS score of 8.8 and low attack complexity make this a credible, actionable priority; vendor patches are available. Code execution occurs in the context of the user who opens the file, and user interaction is required.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to execute arbitrary code in the context of the opening user when a crafted workbook is opened or previewed (user interaction required). Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 for Windows and Mac, Office 365 for Mac, and Office Online Server. No public exploit has been identified at time of analysis, and Microsoft has released patches; risk is high but not a top-tier emergency given the reliance on social engineering.
Heap-based buffer overflow in Microsoft Word allows an unauthenticated attacker to execute arbitrary code in the context of the victim when the victim opens a crafted Word document. The vulnerability affects Microsoft 365 Apps for Enterprise, Office LTSC 2024, Office LTSC 2021, and Office LTSC/365 for Mac 2021/2024. Microsoft has released vendor patches; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. User interaction (opening the document) is the primary limiting factor, and code execution is confined to the user's security context (S:U).
Local privilege escalation in Microsoft OneNote stems from a use-after-free memory corruption flaw (CWE-416) that an authenticated attacker with low-privilege local access can trigger to execute code in a higher-privileged context. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and the corresponding Mac editions. No public exploit has been identified at time of analysis, and vendor patches are available; given the local access prerequisite and patch availability, this is a patch-priority item rather than an emergency.
Opening a specially crafted document in an affected Microsoft Word build triggers a heap-based buffer overflow that lets an attacker execute code in the context of the user who opened the file. Affected builds are Microsoft Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, and Microsoft 365 Apps for Enterprise installations older than the current fixed release. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms the attack requires the victim to open the malicious file, but no attacker credentials or prior privileges are needed; no public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available.
Stack-based buffer overflow in Microsoft Office Word enables a local, authenticated user to elevate privileges to the level of the affected process, resulting in high confidentiality, integrity, and availability impact on the host (CVSS 3.1 base 7.8 HIGH). Affected builds include Microsoft Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, and Office LTSC/365 for Mac. A vendor patch is available; no public exploit code or confirmed active exploitation has been identified at time of analysis.
A security-feature bypass in Microsoft Word allows an attacker-crafted document to subvert an Office security decision when the file is opened on the local machine, rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with high confidentiality, integrity, and availability impact. No privileges or authentication are required, but the attacker depends entirely on convincing the victim to open the malicious document, so delivery is social-engineering based rather than unattended. This is tracked as CWE-807 (reliance on untrusted inputs in a security decision) and EUVD-2026-100189; no public exploit identified at time of analysis, and Microsoft has published a fix (patch available per vendor advisory).
A heap-based buffer overflow in Microsoft PowerPoint allows an unauthenticated attacker to execute arbitrary code in the security context of a user who opens a specially crafted presentation file, with impact rated to confidentiality, integrity, and availability all High. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 for Windows, and Office 365 / Office LTSC 2021 and 2024 for Mac; exploitation requires the victim to open the malicious file (UI:R) delivered out-of-band via email, chat, or web download, and the high attack complexity metric reflects additional attacker-side prerequisites such as winning a specific heap memory layout. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical limits on exploitation remain the required user interaction plus Protected View and Mark-of-the-Web protections applied to files from untrusted sources.
Heap-based buffer overflow in Microsoft Word enables unauthenticated remote attackers to execute arbitrary code if a victim opens a crafted document. The flaw affects Microsoft Office LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Office for Mac; a vendor-released patch is available. No public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as none and automatable as no, reflecting the required user interaction.
Heap-based buffer overflow in Microsoft Office allows unauthenticated remote attackers to execute arbitrary code in the context of the victim user, but only if that user is convinced to open a specially crafted document (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected installations span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and Office LTSC 2021/2024 plus Office 365 for Mac, so both Windows and macOS environments are in scope. No public exploit code or confirmed active exploitation was identified at time of analysis, and the mandatory user interaction (UI:R) - together with Protected View and untrusted-document blocking - is the principal factor limiting real-world exposure; this is a credible prioritization candidate rather than a top-tier emergency on current signals. Microsoft has released vendor patches addressing the flaw.
Remote code execution in Microsoft Office allows an unauthenticated attacker to execute arbitrary code by convincing a user to open a specially crafted document. This heap-based buffer overflow affects Office LTSC 2021 (before 16.0.14334.20974), Office LTSC 2024 (before 16.0.17932.21056), Microsoft 365 Apps for Enterprise, and Mac versions of Office LTSC 2021/2024 and Office 365 for Mac. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation as none, though the vulnerability is high-priority due to total technical impact and network attack vector; patching is available from Microsoft.
Remote code execution in Microsoft Office Word arises from a heap-based buffer overflow that an unauthenticated attacker can trigger by delivering a specially crafted Word document that the victim then opens; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms full compromise of confidentiality, integrity and availability of the user's session, but also confirms that user interaction (UI:R) is the gating precondition. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and Office LTSC/365 for Mac 2021 and 2024, with Windows LTSC fixed versions published as 16.0.14334.20974 (LTSC 2021) and 16.0.17932.21056 (LTSC 2024). No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA SSVC Exploitation: none, Automatable: no), and Microsoft has released patched builds, so this is a credible, actionable remediation priority rather than an emergency-compromise scenario.
Remote code execution in Microsoft Word for Windows and macOS is possible through a heap-based buffer overflow (CWE-122) that is triggered when an affected Office build processes a specially crafted Word document delivered over a network, typically as an email attachment or a web download. The vulnerability is unauthenticated (PR:N) but requires user interaction: the victim must open the malicious document, and the AC:H rating reflects that the attacker must achieve reliable heap layout and grooming to convert the memory corruption into code execution. When successful the outcome is total loss of confidentiality, integrity and availability on the victim's system, although no public exploit code has been identified and CISA's SSVC review records no active exploitation and no automatable path, making this a targeted-attack risk rather than a wormable or mass-exploitation event. Microsoft has released patched builds for the affected Windows and macOS channels.
Remote code execution in Microsoft PowerPoint allows unauthenticated attackers to execute arbitrary code with the privileges of the opening user by delivering a specially crafted presentation that must be opened or rendered. Affected builds include Microsoft Office LTSC 2021 before 16.0.14334.20974, LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, and the macOS Office LTSC 2021/2024 and 365 for Mac editions; vendor patches are available. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none', though the raw CVSS score is 9.8 because successful exploitation yields total confidentiality, integrity, and availability impact.
Remote code execution affects Microsoft Outlook through a stack-based buffer overflow (CWE-121) that a remote attacker can trigger by delivering attacker-controlled content to the victim's Outlook client, with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicating an unauthenticated, no-interaction attack and a maximum impact rating of 9.8 (C:H/I:H/A:H). Impact is total: successful exploitation corrupts stack memory in the Outlook process and can yield code execution in the context of the logged-on user, including full read/write access to mail data and the ability to pivot on the endpoint. No public exploit identified at time of analysis - CISA's SSVC assessment records Exploitation as "none" while rating the attack Automatable (yes) and Technical Impact as total, meaning scalable exploitation is technically feasible once exploit code is developed; patched builds are listed by the vendor for the Windows LTSC lines while several Mac and subscription builds are still tied to pending publication.
Remote code execution in Microsoft Word (part of Microsoft 365 Apps, Office LTSC 2021/2024, and Office for Mac) allows an unauthenticated attacker to execute arbitrary code in the context of a user who opens a crafted document. The vulnerability arises from use of an uninitialized resource (CWE-908) in Word's document parsing; although user interaction is required (UI:R), no privileges are needed on the attacker side (PR:N) and successful exploitation yields high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit code has been identified at time of analysis, but Microsoft has released patches for affected builds.
Remote code execution in Microsoft Excel allows an unauthorized attacker to run arbitrary code on a victim's machine when the target opens a specially crafted workbook, delivered over a network via email attachment, web download, or a shared file. The flaw is a heap-based buffer overflow (CWE-122) in affected Office builds, carrying a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); no authentication or prior access is required, but the attacker is dependent on the victim opening the file, which is why CISA's SSVC assessment rates exploitation as none and the issue as non-automatable. Affected configurations include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024, and the listed macOS Office editions prior to their fixed builds. At time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, so this is a high-priority but not top-of-queue patch item; no EPSS probability was supplied with the source data.
Use-after-free memory corruption in Microsoft PowerPoint enables unauthenticated remote attackers to execute arbitrary code on a victim's machine when a maliciously crafted presentation is opened. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms no authentication is required, but exploitation depends on the target opening the attacker-supplied file, making email attachments, chat-delivered documents, and shared links the practical delivery vectors. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and the macOS Office SKUs; the vendor has released updates, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Microsoft Office Click-To-Run allows an attacker who already holds a low-privileged foothold on a Windows host to turn a use-after-free (CWE-416) memory-corruption flaw into full compromise of the affected process context, rated CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with high confidentiality, integrity and availability impact and no user interaction required. The affected deployments are Microsoft Office installed and serviced through Click-To-Run: Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. Because the vector is AV:L/PR:L, this is an authenticated, post-access escalation primitive rather than a remote or unauthenticated attack path, and no public exploit code or confirmed active exploitation was identified at the time of analysis; Microsoft has released patched builds. The practical risk is bounded by the prerequisite initial foothold, and reliable exploitation additionally depends on winning the heap reuse/grooming required to control the freed object.
Local privilege escalation in Microsoft Office Click-To-Run allows an authenticated low-privileged attacker who already has code execution on a target host to trigger a use-after-free (CWE-416) and gain elevated privileges. The flaw affects Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 installations, requires no user interaction, and has no remote attack surface; no public exploit has been identified at time of analysis. CISA SSVC rates exploitation as none and automatable as no, and vendor patches are available.
Stack-based buffer overflow in Microsoft Word affects Office LTSC 2021, Office LTSC 2024, Microsoft 365 Apps for Enterprise, and the Mac editions of Office, allowing a remote attacker to execute code in the context of the victim who opens a specially crafted Word document (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No attacker privileges are required, but exploitation depends on user interaction - typically an email attachment or a web-downloaded document - which is the primary limiting factor and is why CISA's SSVC assessment records Exploitation: none and Automatable: no. Microsoft has released vendor patches and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Excel allows unauthenticated remote attackers to execute arbitrary code when a victim opens a specially crafted Excel document, affecting Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, Microsoft 365 Apps for Enterprise, and corresponding Mac editions. Exploitation requires user interaction (opening a malicious file) and no public exploit or active exploitation is currently identified, per SSVC (Exploitation: none). Vendor patches are available, and code execution occurs only with the privileges of the user who opens the file.
Heap-based buffer overflow in Microsoft Word lets an unauthenticated remote attacker execute arbitrary code in the context of the user who opens a specially crafted document, affecting Office LTSC 2021 and LTSC 2024, Microsoft 365 Apps for Enterprise, and the Office LTSC/365 for Mac channels. Because the flaw triggers only when the victim opens the malicious file (CVSS UI:R) and SSVC marks it non-automatable, exploitation depends on social engineering rather than automated mass attacks, even though a successful hit yields total loss of confidentiality, integrity and availability (CVSS 8.8). A vendor patch is available; no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow in Microsoft Word allows remote code execution when a user opens or previews a specially crafted document. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 on Windows, and Office LTSC for Mac 2021/2024 plus Office 365 for Mac, with a CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and total technical impact per CISA's SSVC. Exploitation requires the victim to open the malicious document (UI:R), so it is not reachable through passive network traffic or automated scanning, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; vendor patches are available and should be prioritized given the high impact.
Remote code execution in Microsoft Office Word is possible when a crafted document exploits an untrusted pointer dereference (CWE-822), letting an attacker run arbitrary code with the privileges of the user who opens the file. Affected builds are Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and Microsoft 365 Apps for Enterprise (channel-based, fix delivered through the Microsoft Office security release channel). The input rates this 9.8 with a UI:N vector, but the independent assessment resolves user interaction as required (UI:R) because the victim must open - or conceivably preview - the malicious Word document, and no authentication is required of the attacker (PR:N); that interaction requirement materially lowers real-world risk below what a 9.8 no-interaction score implies, and there is no public exploit identified at time of analysis (CISA SSVC records Exploitation: none, and KEV/PoC signals are absent). Microsoft has released vendor patches, so the exposure window is bounded by patching cadence.
Heap-based buffer overflow in Microsoft Outlook allows an unauthenticated remote attacker to execute code over a network by delivering a crafted email message that Outlook processes during parsing or rendering. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) asserts no privileges and no user interaction, implying a zero-click/preview-pane trigger against default configurations; the impact is scoped to installations running the vulnerable builds of Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 365 for Mac, and Office LTSC for Mac 2021/2024. CISA's SSVC assessment reports Exploitation: none and no public exploit code has been identified at time of analysis, but the issue is rated Automatable: yes with Technical Impact: total, and a vendor patch is available - this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-real-risk case.
Heap-based buffer overflow in Microsoft Word allows remote attackers to execute code in the context of the user who opens a crafted Word document. Exploitation requires the victim to open an attacker-supplied file (CVSS UI:R) and no authentication or prior privileges (PR:N), with code running only in the opening user's context and no privilege escalation (S:U); SSVC marks the attack non-automatable, and no public exploit has been identified at time of analysis. Vendor patches are available, including fixed builds for Office LTSC 2021 and LTSC 2024, with updates for Mac and Microsoft 365 Apps distributed through Microsoft's Office security release channel.
Heap-based buffer overflow in Microsoft Office Outlook (CWE-122) lets a remote, unauthenticated attacker execute arbitrary code in the context of the Outlook process by delivering a specially crafted message or object that the victim must open or render. Affected builds per EUVD-2026-99711 are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 below 16.0.14334.20974, and Microsoft Office LTSC 2024 below 16.0.17932.21056; CVSS 3.1 is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with the mandatory user interaction being the only meaningful barrier. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, and SSVC records Exploitation=none with Automatable=no, so this is a credible mid-to-high priority client-side issue rather than an emergency; no EPSS score was supplied in the feed, so no probabilistic exploitation estimate can be cited.
An out-of-bounds read in Microsoft Outlook allows an unauthenticated, remote attacker to disclose information by getting crafted content parsed or rendered by the Outlook client, rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) by the vendor with confidentiality-only impact. Our independent assessment keeps the network vector and high confidentiality impact but conservatively scores user interaction as required (UI:R), because the crafted message or attachment must actually reach a mailbox and be opened or previewed by Outlook - a delivery-and-render precondition, not a directly reachable network service. No public exploit code has been identified at time of analysis (CISA SSVC rates exploitation as 'none' and the issue is not in KEV), and a vendor patch is available, placing this in the important-but-not-emergency tier.
Local privilege escalation in Microsoft Office Click-To-Run arises from a use-after-free memory corruption flaw that lets an attacker who already holds low-privileged local access on a Windows host elevate to higher integrity, with high impact to confidentiality, integrity, and availability. Affected installations include Microsoft 365 Apps for Enterprise (16.0.1 branch), Microsoft Office LTSC 2021 below 16.0.14334.20974, and Microsoft Office LTSC 2024 below 16.0.17932.21056; the attack is local-only (AV:L), requires authenticated low-privileged code execution (PR:L), needs no user interaction (UI:N), and carries high attack complexity (AC:H) because of the heap-state/race conditions inherent to reliable use-after-free exploitation. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', so this is a moderate-to-high priority patching item rather than an emergency; a vendor patch is available.
Heap-based buffer overflow in Microsoft Word allows unauthenticated remote attackers to execute arbitrary code when a crafted document is parsed, though exploitation is difficult to trigger reliably (AC:H) and, per our assessment, requires the victim to open or preview the malicious file (UI:R). Microsoft's advisory vector lists UI:N (no user interaction), which would suggest an automatic preview-pane path; this discrepancy should be resolved with MSRC because UI:R materially lowers real-world exploitability. A vendor patch is available for all affected Office channels, no public exploit code or CISA KEV entry was identified at time of analysis, and SSVC marks the flaw non-automatable, making this a serious but not emergency-tier vulnerability.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and corresponding Office for Mac editions when a victim opens a specially crafted document that triggers a heap-based buffer overflow. The attacker is unauthenticated (PR:N), but exploitation requires user interaction (UI:R), and any code runs in the context of the opening user (S:U) without crossing a privilege boundary. Microsoft has released patches; no public exploit identified at time of analysis, so treat this as a high-priority phishing-borne update item rather than a remotely triggerable no-interaction emergency.
Heap-based buffer overflow in Microsoft Outlook lets an unauthenticated remote attacker execute arbitrary code in the context of the user who opens or previews a specially crafted email or attachment, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2024 before 16.0.17932.21056, and Office LTSC 2021 before 16.0.14334.20974. Exploitation is gated by mandatory victim interaction (UI:R) and code runs at the interacting user's privilege level rather than SYSTEM (S:U), so it is a high-priority but not emergency-level issue. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as none with total technical impact; vendor-released patches are available. Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (CVSS 8.8); CWE-122; EUVD-2026-99710.
Heap-based buffer overflow in Microsoft Outlook allows remote code execution in the context of the logged-on user when a victim opens or renders a specially crafted email item. Affected builds are Microsoft 365 Apps for Enterprise and Microsoft Office LTSC 2024 prior to 16.0.17932.21056; the flaw is network-reachable and requires no authentication on the target (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, rated 8.8, CWE-122). CISA's SSVC assessment records no observed exploitation and non-automatable delivery, and no public exploit code has been identified at time of analysis, so this is a credible high-priority patching item rather than a confirmed emergency - mitigated in practice by mandatory user interaction and user-level (non-admin) execution context.
Remote code execution in Microsoft Excel (CVSS 8.8) becomes possible when an unauthenticated attacker convinces a victim to open a specially crafted spreadsheet, triggering an out-of-bounds read (CWE-125) that can be turned into memory corruption and code execution in the context of the user who opened the file. Affected configurations include Microsoft Office LTSC 2021 below 16.0.14334.20974, Microsoft Office LTSC 2024 below 16.0.17932.21056, Microsoft 365 Apps for Enterprise, and Office 365 for Mac. No public exploit has been identified at time of analysis, CISA's SSVC decision framework records exploitation as none and the issue as not automatable, and vendor-released patches are available, making this a high-priority patch target rather than an emergency.
Heap-based buffer overflow in Microsoft Outlook lets an unauthenticated remote attacker execute arbitrary code by getting a crafted message processed by a vulnerable client, with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWE-122 as the root-cause class. Affected builds are Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft Office LTSC 2021 before 16.0.14334.20974, and unpatched Microsoft 365 Apps for Enterprise channels; because the assessed vector carries PR:N/UI:N, delivery of a malicious message to the mailbox is sufficient under default configurations, with patch state as the main limiting factor. Vendor-released patch: available from Microsoft per the MSRC update guide; there is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' while flagging the flaw as automatable with total technical impact.
Code execution in Microsoft Word is possible when a user opens a specially crafted document that triggers a heap-based buffer overflow (CWE-122) in the application's document parsing logic. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): exploitation is unauthenticated and needs no elevated privileges, but it is local in nature and requires the victim to open a malicious file, meaning an attacker must first succeed at social engineering - the SSVC assessment records Exploitation=none, Automatable=no, and there is no public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) activity. Successful exploitation yields arbitrary code only in the security context of the user who opened the document, not inherently SYSTEM or administrator, so the practical risk is a workstation-level compromise rather than immediate full host takeover.
Remote code execution in Microsoft PowerPoint stems from a use-after-free memory corruption flaw (CWE-416) that an unauthenticated remote attacker can trigger by delivering a maliciously crafted PowerPoint/Office document to a victim, who must then open it (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and the macOS Microsoft 365/Office LTSC releases identified in EUVD-2026-100169. CISA SSVC records exploitation as 'none' and automatable as 'no', so no public exploit identified at time of analysis, and Microsoft has published fixed versions through the MSRC update guide.
Out-of-bounds read in Microsoft Excel allows a remote, unauthenticated attacker to execute arbitrary code when a victim opens a maliciously crafted spreadsheet. The vulnerability requires user interaction (CVSS UI:R) and stems from improper input validation (CWE-20); successful exploitation can fully compromise confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, but the high CVSS score (8.8) and the lack of a confirmed fixed version in the provided data make this a high-priority patching item.
Heap-based buffer overflow in Microsoft Access lets an attacker execute arbitrary code at the privilege level of a user who opens a specially crafted Access database file, scoring CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No credentials or target-side configuration are needed, but the attack chain depends on the victim opening or interacting with the malicious file (UI:R), making file delivery and social engineering the main barrier; Microsoft has published a fix via its update-guide advisory. There is no CISA KEV entry and no public exploit identified at time of analysis, though the high impact across confidentiality, integrity and availability makes prompt patching a genuine priority.
Heap-based buffer overflow in Microsoft Office Access allows remote code execution when a victim opens a malicious, attacker-crafted Access file such as an .accdb or .mdb database or an embedded object. Affected users are those with Access installed on the target host: no authentication to the system is required (PR:N) and attack complexity is low (AC:L), but exploitation is gated by the mandatory victim interaction (UI:R) of opening the crafted file, and any code executes only with the opening user's privileges (S:U). No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the MSRC advisory is the authoritative reference, and CVSS 8.8 reflects high confidentiality, integrity, and availability impact, making this a credible operational priority rather than a drop-everything emergency.
Integer overflow (CWE-190) in Microsoft Word's document parsing can allow an unauthenticated, network-delivered attacker to execute code in the context of the victim by convincing them to open a specially crafted Word document. Exploitation requires user interaction (UI:R) and high attack complexity (AC:H), and impact is confined to the user's Word process (scope unchanged). No public exploit identified at time of analysis, making this a moderately high but not top-tier priority for most organizations.
Heap-based buffer overflow in Microsoft Access enables unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted database file. Exploitation is non-trivial due to high attack complexity (AC:H) and requires user interaction (UI:R), but successful exploitation grants code execution with the user's privileges. No public exploit code has been identified at time of analysis, and a vendor patch is available via the Microsoft Security Response Center.
Heap-based buffer overflow in Microsoft PowerPoint allows unauthenticated remote attackers to execute arbitrary code when a victim opens a specially crafted presentation file, but exploitation requires user interaction and reliable heap corruption against modern memory-safety mitigations (AC:H). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is considered moderate-to-high due to the social engineering delivery and Protected View defenses that can impede successful attacks. This vulnerability affects Microsoft Office PowerPoint installations that have not received the update referenced in the Microsoft Security Update Guide.