Microsoft Office Ltsc 2024
Monthly
Information disclosure in Microsoft Excel (and the broader Office family - Office 2019, Office LTSC 2021/2024, Office for Mac, Microsoft 365 Apps for Enterprise, and Office Online Server) allows an attacker to read memory beyond an allocated buffer when a victim opens a crafted spreadsheet, potentially leaking sensitive in-process data. Exploitation is local and requires user interaction (opening the malicious file); there is no public exploit identified at time of analysis and CISA SSVC scores exploitation as 'none'. EPSS is very low (0.06%, 18th percentile), indicating negligible observed exploitation activity, though the technical impact is rated 'total'.
Memory corruption in Microsoft Office Word enables local code execution through a use-after-free flaw affecting Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 for Windows and Mac. Despite the local attack vector (AV:L), the vulnerability requires no privileges (PR:N) or user interaction (UI:N), allowing unauthorized attackers to execute arbitrary code with high impact to confidentiality, integrity, and availability (CVSS 8.4). Vendor-released patch available via Microsoft Security Response Center as of April 2026. No public exploit identified at time of analysis, though the technical simplicity (AC:L) and memory corruption primitive increase weaponization risk.
Microsoft Office Word untrusted pointer dereference (CWE-822) enables local code execution with high impact across Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 editions (Windows and macOS). The vulnerability requires local access but no privileges or user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:N), allowing unauthenticated local attackers to achieve full system compromise. Vendor-released patch available per Microsoft Security Response Center advisory. No public exploit identified at time of analysis. SSVC assessment indicates no confirmed exploitation, non-automatable attack, but total technical impact (full control).
Use-after-free memory corruption in Microsoft PowerPoint (versions 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise) enables local code execution when users open malicious files. An attacker with no privileges can achieve full system compromise (high confidentiality, integrity, and availability impact) by convincing a user to open a crafted PowerPoint document. Vendor patch available via Microsoft Security Response Center. No public exploit code or confirmed active exploitation (CISA KEV) identified at time of analysis, though CVSS 7.8 rating reflects high severity for local attack scenarios.
Microsoft Excel use-after-free vulnerability (CWE-416) enables arbitrary code execution when a user opens a specially crafted Excel file. Affects Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024 (Windows and Mac), and Office Online Server. CVSS 7.8 (High) requires local access and user interaction but no authentication. No public exploit identified at time of analysis. Microsoft released patches addressing all affected product lines per MSRC update guide.
Use-after-free vulnerability in Microsoft Office Excel enables local code execution when users open maliciously crafted Excel files. Affects all major Office versions including Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024 (Windows and Mac), and Office Online Server. Attack requires no authentication (PR:N) but demands user interaction (opening a weaponized document). CVSS 7.8 (High) reflects significant impact potential (code execution with high confidentiali
Use-after-free memory corruption in Microsoft Excel across Office 2016-2024 and Microsoft 365 enables local code execution when a user opens a malicious spreadsheet. Attackers must craft a weaponized Excel file and trick users into opening it, after which arbitrary code runs with the victim's privileges. No authentication is required, though user interaction is necessary. Exploitation probability remains moderate (CVSS 7.8) with no confirmed active exploitation (no CISA KEV listing) and no publi
Use-after-free memory corruption in Microsoft Office (versions 2016 through LTSC 2024, including Microsoft 365 Apps for Enterprise) enables local code execution with no authentication or user interaction required. Attackers with local system access can execute arbitrary code with high impact to confidentiality, integrity, and availability (CVSS 8.4). No public exploit identified at time of analysis. Vendor-released patch available via Microsoft Security Response Center for all affected versions.
Local code execution in Microsoft Office Word via use-after-free memory corruption affects Microsoft 365 Apps for Enterprise and Office LTSC 2024. Unauthenticated attackers can achieve full system compromise (confidentiality, integrity, availability) by inducing users to open specially crafted Word documents, triggering memory reuse vulnerabilities during document parsing. Vendor patch available via Microsoft Security Response Center. No public exploit identified at time of analysis, though CVSS 7.8 indicates high severity when user interaction occurs.
Use-after-free memory corruption in Microsoft Office Word enables local code execution with high privileges when victims open malicious documents. Affects Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 for Windows and Mac (versions below 16.108.26041219 for Mac; click-to-run editions require latest security updates). CVSS 7.8 reflects local attack vector requiring user interaction, but exploitation grants complete system compromise (confidentiality, integrity, availability all rated High). No public exploit identified at time of analysis, though use-after-free vulnerabilities are well-understood exploitation primitives. Vendor-released patch available through Microsoft security updates.
Microsoft Excel memory corruption via use-after-free enables arbitrary code execution when victims open malicious spreadsheet files. This vulnerability affects all major Office deployments including Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, and Office LTSC 2021/2024 for both Windows and macOS, as well as Office Online Server. Attackers require user interaction to open a crafted file, but no authentication is needed (CVSS PR:N), making this exploitable through phishing or file-sharing attacks. Vendor patches are available through Microsoft Security Response Center. No public exploit or active exploitation confirmed at time of analysis, though the straightforward attack vector (local file + user click) and high impact (code execution with full system privileges) warrant prompt patching.
Out-of-bounds read vulnerability (CWE-125) in Microsoft Excel allows local attackers to disclose sensitive memory contents and cause denial of service through maliciously crafted spreadsheet files with user interaction. Affects Microsoft Office 2016/2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office Online Server across Windows and macOS platforms. CVSS 7.1 reflects high confidentiality and availability impact with low attack complexity but requires local access and user interaction. No public exploit identified at time of analysis. Vendor-released patches available through Microsoft Security Response Center covering all affected Office product lines.
An out-of-bounds memory read in Microsoft PowerPoint lets remote attackers leak information from the memory of the affected Office process when a user opens a specially crafted presentation file. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), meaning confidentiality is heavily impacted while integrity and availability are untouched, and it affects Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021/2024 on both Windows and macOS. No public exploit has been identified at time of analysis, but the attack path is straightforward: an unauthenticated attacker only needs to convince a victim to open a malicious .ppt/.pptx file, so email and web-delivered documents remain the primary delivery vector. A vendor patch is available through Microsoft's update guide.
An information disclosure vulnerability in Microsoft PowerPoint allows a remote, unauthenticated attacker to trigger an out-of-bounds memory read by convincing a victim to open a specially crafted presentation file, potentially exposing heap contents that may contain sensitive data. Affected builds span Microsoft 365 Apps for Enterprise, Office 365 for Mac, and the Office LTSC 2021 and 2024 releases on both Windows and macOS. The attacker needs no credentials (PR:N), but the attack hinges entirely on user interaction (UI:R) - the document must be opened, and Protected View or Mark-of-the-Web handling for externally sourced files can interrupt the chain. Microsoft has released a vendor patch and no public exploit code or active exploitation has been identified at time of analysis.
Opening a specially crafted PowerPoint document in an unpatched Microsoft Office build can trigger an out-of-bounds read that leaks the contents of process memory to the attacker. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and the corresponding Office for Mac / LTSC for Mac 2021 and 2024 clients; exploitation is remote and needs no credentials (AV:N/PR:N) but hinges entirely on user interaction (UI:R), since the victim must open or preview the malicious file. The result is read-only memory disclosure (C:H, I:N, A:N) rather than code execution or data tampering, and there is no public exploit identified at time of analysis, though a vendor patch is available per the Microsoft Security Response Center advisory.
An out-of-bounds read in Microsoft Word (CWE-125) lets remote, unauthenticated attackers disclose the contents of process memory when a victim opens a specially crafted document, with affected builds spanning Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC 2021/2024, and Office LTSC for Mac 2021/2024. Exploitation requires the user to open the malicious file (UI:R) and deliver it successfully through social engineering, so it is not a zero-click or wormable flaw, and the impact is limited to information disclosure (C:H, I:N, A:N) without code execution or persistence. No public exploit code has been identified at time of analysis, and Microsoft has published a vendor patch through its update guide.
Information disclosure in Microsoft Word (and the broader Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021/2024 families) allows a remote attacker to read memory contents from the affected application by convincing a victim to open a specially crafted document. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N): the attacker needs no authentication, but exploitation hinges on user interaction - the target must open the malicious file - so delivery depends on phishing or social engineering rather than automatic remote compromise. Impact is limited to confidentiality (no code execution, integrity, or availability effect) and remains confined to the vulnerable process; there is no public exploit identified at time of analysis and no evidence of confirmed active exploitation, though the disclosure of high-value memory contents can still expose sensitive document data or session material. Microsoft has published a vendor patch via its MSRC update guide.
An out-of-bounds read in Microsoft Word (CVE-2026-108434, CVSS 6.5) allows a remote, unauthenticated attacker to disclose information from process memory if the victim opens or previews a specially crafted Word document. Affected builds are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and Office LTSC for Mac 2021/2024 plus Office 365 for Mac, per the vendor CPE list. Because the vector requires user interaction (UI:R) and the impact is limited to confidentiality (C:H with I:N/A:N), there is no zero-click or server-side exploitation path; Microsoft has published a fix through its MSRC update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a moderate-priority patching item rather than an emergency.
Memory parsing across Microsoft Office and SharePoint Server products is susceptible to a CWE-125 out-of-bounds read that, when triggered by opening a specially crafted Office document, produces local information disclosure or application availability loss. The affected surface is broad - spanning Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024 on both Windows and macOS, and SharePoint Enterprise Server 2016, 2019, and Subscription Edition - but real-world exploitation pressure is low: EPSS sits at 0.36% (28th percentile), CISA SSVC rates exploitation as none and the attack as non-automatable, and no public exploit has been identified at time of analysis. Vendor-released patches are available for all affected product lines.
Out-of-bounds read in Microsoft Office exposes sensitive memory contents to a local, unauthenticated attacker who can induce a user to open a malicious document. Affected products span the full current Office portfolio - Office 2016 through LTSC 2024 on both Windows and macOS - making the blast radius broad despite the local attack vector. No public exploit identified at time of analysis and SSVC classifies exploitation as none and not automatable, though the high confidentiality impact (C:H) and near-universal deployment of Office keep this a meaningful patching priority.
Out-of-bounds read in Microsoft Office and SharePoint exposes process memory contents locally when a user opens a specially crafted document. Affected products span the full Office suite - Office 2016, 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise (Windows and Mac), and SharePoint Server 2016, 2019, and Subscription Edition - covering virtually the entire active Office install base. No public exploit code exists and CISA SSVC rates exploitation as none, making this a patch-and-monitor priority rather than an emergency response.
Information disclosure in Microsoft Office (Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and Office for Mac) arises from an out-of-bounds read (CWE-125) that lets an attacker who convinces a victim to open a crafted file read memory beyond an intended buffer boundary. Exploitation is local and requires user interaction, and there is no public exploit identified at time of analysis and no CISA KEV listing. Disclosed memory can leak sensitive data such as heap contents or pointer addresses useful for defeating ASLR in a follow-on exploit chain.
Out-of-bounds read in Microsoft Office exposes a limited portion of process memory to a local attacker when a user opens a specially crafted document. Affected products span Office 2016 through LTSC 2024 on both Windows and macOS, with impact confined to low-severity information disclosure and no integrity or availability consequence. No public exploit code exists and CISA has not listed this in KEV; SSVC confirms exploitation status as none and the vulnerability is assessed as non-automatable, collectively placing this in the lowest real-world risk tier despite broad product coverage.
Uninitialized memory disclosure in Microsoft Office exposes sensitive data locally when a user interacts with a crafted document. The vulnerability, rooted in CWE-908 (Use of Uninitialized Resource), affects the full breadth of current Office deployments across Windows and macOS, including Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise. No public exploit code has been identified at time of analysis, and SSVC signals confirm no observed exploitation; however, the High confidentiality impact warrants prompt patching given Office's ubiquitous deployment footprint.
Numeric truncation error (CWE-197) in Microsoft Office Word triggers local information disclosure when a user opens a maliciously crafted document, exposing potentially sensitive memory contents with high confidentiality impact (C:H). The vulnerability spans a broad range of Microsoft Office and SharePoint products - including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Word 2016, Office 2019, Office 365 for Mac, and multiple SharePoint Server versions. No public exploit identified at time of analysis; CISA SSVC rates exploitation as none, EPSS stands at 0.39% (31st percentile), and a vendor-released patch is available from Microsoft.
Microsoft Office information disclosure via integer overflow (CWE-190) exposes high-confidentiality data to a local attacker who can induce a victim to open a crafted document. The flaw affects a broad range of Microsoft Office versions on both Windows and macOS - including Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise - confirmed by Microsoft via MSRC. No public exploit code exists and CISA SSVC rates exploitation as none, placing this in low urgency despite the High confidentiality impact in the CVSS vector; however, the extensive product footprint means patching remains advisable.
Out-of-bounds read in Microsoft Excel's file parser discloses sensitive memory contents when a victim opens a specially crafted workbook, affecting Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC for Mac 2021/2024, and Office Online Server. The CVSS vector (AV:N/PR:N/UI:R/C:H) indicates unauthenticated network delivery with mandatory user interaction and high confidentiality impact. No public exploit identified at time of analysis; SSVC confirms no known active exploitation and EPSS at 0.64% (46th percentile) reflects below-average exploitation probability, positioning this as a targeted phishing risk rather than an opportunistic threat.
Out-of-bounds read in Microsoft Office (including 365 Apps for Enterprise, Office 2016/2019, LTSC 2021/2024 on Windows and macOS, and SharePoint Server 2016/2019/Subscription Edition) allows a local attacker to disclose limited memory contents when a victim opens a specially crafted document. The CVSS 3.3 Low score, EPSS of 0.51% (40th percentile), SSVC exploitation status of 'none,' and absence from CISA KEV collectively place this vulnerability at low real-world priority despite its broad product footprint. No public exploit or proof-of-concept code has been identified at time of analysis.
Information disclosure in Microsoft Office Word and related Microsoft 365/SharePoint products exposes sensitive memory contents when a user opens a specially crafted document. Affecting a broad suite of products spanning Word 2016 through Office LTSC 2024 and SharePoint Server versions, the flaw stems from improper input type validation (CWE-1287) in the document parsing subsystem. No public exploit has been identified at time of analysis; EPSS at 0.39% and CISA SSVC exploitation status of 'none' confirm this remains a theoretical rather than actively targeted risk, though Microsoft has released patches.
Untrusted pointer dereference (CWE-822) in Microsoft Excel allows a local attacker to disclose sensitive memory contents when a victim opens a specially crafted workbook. The flaw affects a broad swath of Microsoft Office product lines - from Excel 2016 through Office LTSC 2024 and their Mac counterparts - as confirmed by CPE enumeration. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates exploitation as none and technical impact as partial, placing this in the moderate real-world priority tier despite the C:H CVSS rating.
Out-of-bounds read in Microsoft Office Word and associated Microsoft 365 products allows local information disclosure when a user opens a specially crafted document. Affecting a broad range of Microsoft Office versions across Windows and macOS - including Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365 for Mac, and SharePoint Server 2016/2019/Subscription Edition - an attacker with no prior system privileges must socially engineer a victim into opening a malicious file to trigger memory disclosure. No public exploit identified at time of analysis; EPSS is 0.39% (31st percentile) and SSVC confirms exploitation status as none and the attack as non-automatable.
Out-of-bounds read in Microsoft Office exposes high-confidentiality memory contents to a local, unauthenticated attacker who can induce a user to open a crafted document. The flaw affects a wide swath of Office and SharePoint products across Windows and Mac platforms, including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, Office 365 for Mac, and SharePoint Server 2016 through the Subscription Edition. No public exploit has been identified at time of analysis, EPSS is low at 0.50% (39th percentile), and CISA SSVC rates exploitation as none and the flaw as non-automatable, placing this firmly in a patch-and-monitor risk tier rather than an emergency-response tier.
Out-of-bounds memory read in Microsoft Office and SharePoint exposes sensitive in-process data when a user opens a specially crafted document on a local machine. Affecting Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024 (Windows and macOS), and SharePoint Server 2016 through Subscription Edition, the CWE-125 flaw allows an unauthorized attacker to read beyond allocated buffer boundaries, achieving High confidentiality impact with no integrity or availability consequence. No public exploit exists and no active exploitation is confirmed at time of analysis - CISA SSVC rates exploitation status as none - making this a routine-priority patch despite the broad product coverage.
Out-of-bounds read in Microsoft Office and SharePoint Server exposes local memory contents to an unauthorized attacker, resulting in information disclosure. The vulnerability (CWE-125) is triggered when a user opens a specially crafted Office document, making exploitation dependent on user interaction rather than remote network access. No active exploitation has been confirmed - CISA KEV does not list this CVE, SSVC rates exploitation as none, and EPSS probability sits at 0.51% (40th percentile), collectively indicating low real-world threat activity despite the wide deployment footprint of affected products.
Local information disclosure in Microsoft Office and SharePoint via an integer overflow (CWE-190) exposes sensitive data to low-privileged local attackers across a broad range of Office versions on both Windows and Mac platforms. The CVSS vector (AV:L/PR:L) confirms exploitation requires an existing foothold on the target machine, limiting real-world impact to post-compromise scenarios or insider threats. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.40% (32nd percentile) combined with SSVC exploitation status of 'none' indicates this is not currently being weaponized in the wild.
Out-of-bounds read (CWE-125) in Microsoft Office's file parsing logic exposes potentially sensitive in-memory data to a local attacker when a victim opens a specially crafted document, affecting Windows and macOS Office editions as well as Microsoft SharePoint Server. The CVSS 5.5 Medium score reflects a local-only attack vector with mandatory user interaction, confining impact to information disclosure with no integrity or availability consequence. No public exploit code exists, CISA SSVC classifies exploitation as 'none' with no automation potential, and the EPSS of 0.51% (40th percentile) confirms low current exploitation probability.
Out-of-bounds read in Microsoft Excel's file parsing engine exposes sensitive memory contents when a victim opens a specially crafted workbook, affecting Excel 2016 through Office LTSC 2024 and Office Online Server across both Windows and macOS platforms. The CVSS vector (AV:L/UI:R/C:H/I:N/A:N) confirms impact is limited to confidentiality loss - no code execution results - and requires local user interaction to trigger. No public exploit has been identified and CISA has not listed this in KEV; with an EPSS of 0.46% and SSVC exploitation status of none, this is appropriate for standard patch cycle prioritization rather than emergency response.
Out-of-bounds read in Microsoft Excel and related Office products exposes adjacent process memory to local information disclosure when a user opens a specially crafted spreadsheet file. The flaw spans a broad set of Microsoft Office versions across Windows and macOS - including Excel 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office Online Server - with vendor-released patches now available for all affected builds. No active exploitation has been confirmed by CISA KEV, and EPSS places exploitation probability at 0.35% (27th percentile), consistent with SSVC's assessment of no current exploitation and non-automatable delivery.
Untrusted pointer dereference in Microsoft Excel exposes sensitive in-process memory to a local attacker across virtually the entire Office product family - Excel 2016 through Office LTSC 2024 on Windows and macOS, plus Office Online Server. An attacker must deliver a crafted spreadsheet and induce the victim to open it; successful exploitation yields high confidentiality impact with no integrity or availability effect. No public exploit code or active exploitation has been identified; EPSS at 0.46% (37th percentile) and SSVC exploitation status of 'none' are consistent with low real-world risk at this time.
Information disclosure in Microsoft Office (Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and Office for Mac) via an out-of-bounds read (CWE-125) lets an attacker leak sensitive memory contents when a victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.1 (AV:L/AC:L/PR:N/UI:R), reflecting local exploitation that requires user interaction but no prior authentication. Microsoft is the reporting source and has published a fix; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Out-of-bounds read in Microsoft Excel's spreadsheet parser (CWE-125) exposes affected systems to both local information disclosure and application crash when a victim opens a specially crafted file, spanning Excel 2016 through Office LTSC 2024 and Office 365 for Mac. The CVSS vector (AV:L/UI:R/A:H) reveals that while the CVE description emphasizes information disclosure, the primary real-world impact is application availability - the invalid memory read can crash Excel (A:H), with incidental memory content leakage (C:L) as a secondary effect. No public exploit code has been identified at time of analysis and CISA SSVC assigns exploitation status of none, consistent with a low EPSS score of 0.31% at the 23rd percentile.
Heap-based buffer overflow in Microsoft Office Excel triggers a local information disclosure when a target user opens a maliciously crafted document. Affecting Excel 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS, the vulnerability yields only limited confidentiality impact (C:L) with no integrity or availability consequence, placing it in the Low severity tier at CVSS 3.3. No public exploit code exists and no active exploitation has been confirmed - CISA's SSVC framework rates exploitation as none, automatable as no, and technical impact as partial, consistent with the low EPSS probability of 0.27% (19th percentile).
External control of file name or path (CWE-73) in Microsoft Office Word enables network-based information disclosure when a victim opens a specially crafted document, affecting Word 2016, Office 2019, LTSC 2021/2024, and Microsoft 365 Apps for Enterprise. An unauthenticated remote attacker can exploit this to coerce Word into resolving an attacker-controlled file path - likely a UNC path - causing an outbound network request that leaks sensitive data such as NTLM credentials. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.05% at the 14th percentile indicates negligible real-world exploitation activity at time of analysis.
Local file disclosure in Microsoft Word exposes sensitive files and directories to external parties when a victim opens a specially crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise across version ranges confirmed by NVD CPE data. No public exploit code has been identified and CISA SSVC rates exploitation as none with only partial technical impact; a vendor-released patch is available via the Microsoft Security Response Center.
Information disclosure in Microsoft Excel (and the broader Office family - Office 2019, Office LTSC 2021/2024, Office for Mac, Microsoft 365 Apps for Enterprise, and Office Online Server) allows an attacker to read memory beyond an allocated buffer when a victim opens a crafted spreadsheet, potentially leaking sensitive in-process data. Exploitation is local and requires user interaction (opening the malicious file); there is no public exploit identified at time of analysis and CISA SSVC scores exploitation as 'none'. EPSS is very low (0.06%, 18th percentile), indicating negligible observed exploitation activity, though the technical impact is rated 'total'.
Memory corruption in Microsoft Office Word enables local code execution through a use-after-free flaw affecting Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 for Windows and Mac. Despite the local attack vector (AV:L), the vulnerability requires no privileges (PR:N) or user interaction (UI:N), allowing unauthorized attackers to execute arbitrary code with high impact to confidentiality, integrity, and availability (CVSS 8.4). Vendor-released patch available via Microsoft Security Response Center as of April 2026. No public exploit identified at time of analysis, though the technical simplicity (AC:L) and memory corruption primitive increase weaponization risk.
Microsoft Office Word untrusted pointer dereference (CWE-822) enables local code execution with high impact across Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 editions (Windows and macOS). The vulnerability requires local access but no privileges or user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:N), allowing unauthenticated local attackers to achieve full system compromise. Vendor-released patch available per Microsoft Security Response Center advisory. No public exploit identified at time of analysis. SSVC assessment indicates no confirmed exploitation, non-automatable attack, but total technical impact (full control).
Use-after-free memory corruption in Microsoft PowerPoint (versions 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise) enables local code execution when users open malicious files. An attacker with no privileges can achieve full system compromise (high confidentiality, integrity, and availability impact) by convincing a user to open a crafted PowerPoint document. Vendor patch available via Microsoft Security Response Center. No public exploit code or confirmed active exploitation (CISA KEV) identified at time of analysis, though CVSS 7.8 rating reflects high severity for local attack scenarios.
Microsoft Excel use-after-free vulnerability (CWE-416) enables arbitrary code execution when a user opens a specially crafted Excel file. Affects Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024 (Windows and Mac), and Office Online Server. CVSS 7.8 (High) requires local access and user interaction but no authentication. No public exploit identified at time of analysis. Microsoft released patches addressing all affected product lines per MSRC update guide.
Use-after-free vulnerability in Microsoft Office Excel enables local code execution when users open maliciously crafted Excel files. Affects all major Office versions including Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024 (Windows and Mac), and Office Online Server. Attack requires no authentication (PR:N) but demands user interaction (opening a weaponized document). CVSS 7.8 (High) reflects significant impact potential (code execution with high confidentiali
Use-after-free memory corruption in Microsoft Excel across Office 2016-2024 and Microsoft 365 enables local code execution when a user opens a malicious spreadsheet. Attackers must craft a weaponized Excel file and trick users into opening it, after which arbitrary code runs with the victim's privileges. No authentication is required, though user interaction is necessary. Exploitation probability remains moderate (CVSS 7.8) with no confirmed active exploitation (no CISA KEV listing) and no publi
Use-after-free memory corruption in Microsoft Office (versions 2016 through LTSC 2024, including Microsoft 365 Apps for Enterprise) enables local code execution with no authentication or user interaction required. Attackers with local system access can execute arbitrary code with high impact to confidentiality, integrity, and availability (CVSS 8.4). No public exploit identified at time of analysis. Vendor-released patch available via Microsoft Security Response Center for all affected versions.
Local code execution in Microsoft Office Word via use-after-free memory corruption affects Microsoft 365 Apps for Enterprise and Office LTSC 2024. Unauthenticated attackers can achieve full system compromise (confidentiality, integrity, availability) by inducing users to open specially crafted Word documents, triggering memory reuse vulnerabilities during document parsing. Vendor patch available via Microsoft Security Response Center. No public exploit identified at time of analysis, though CVSS 7.8 indicates high severity when user interaction occurs.
Use-after-free memory corruption in Microsoft Office Word enables local code execution with high privileges when victims open malicious documents. Affects Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 for Windows and Mac (versions below 16.108.26041219 for Mac; click-to-run editions require latest security updates). CVSS 7.8 reflects local attack vector requiring user interaction, but exploitation grants complete system compromise (confidentiality, integrity, availability all rated High). No public exploit identified at time of analysis, though use-after-free vulnerabilities are well-understood exploitation primitives. Vendor-released patch available through Microsoft security updates.
Microsoft Excel memory corruption via use-after-free enables arbitrary code execution when victims open malicious spreadsheet files. This vulnerability affects all major Office deployments including Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, and Office LTSC 2021/2024 for both Windows and macOS, as well as Office Online Server. Attackers require user interaction to open a crafted file, but no authentication is needed (CVSS PR:N), making this exploitable through phishing or file-sharing attacks. Vendor patches are available through Microsoft Security Response Center. No public exploit or active exploitation confirmed at time of analysis, though the straightforward attack vector (local file + user click) and high impact (code execution with full system privileges) warrant prompt patching.
Out-of-bounds read vulnerability (CWE-125) in Microsoft Excel allows local attackers to disclose sensitive memory contents and cause denial of service through maliciously crafted spreadsheet files with user interaction. Affects Microsoft Office 2016/2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office Online Server across Windows and macOS platforms. CVSS 7.1 reflects high confidentiality and availability impact with low attack complexity but requires local access and user interaction. No public exploit identified at time of analysis. Vendor-released patches available through Microsoft Security Response Center covering all affected Office product lines.
An out-of-bounds memory read in Microsoft PowerPoint lets remote attackers leak information from the memory of the affected Office process when a user opens a specially crafted presentation file. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), meaning confidentiality is heavily impacted while integrity and availability are untouched, and it affects Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021/2024 on both Windows and macOS. No public exploit has been identified at time of analysis, but the attack path is straightforward: an unauthenticated attacker only needs to convince a victim to open a malicious .ppt/.pptx file, so email and web-delivered documents remain the primary delivery vector. A vendor patch is available through Microsoft's update guide.
An information disclosure vulnerability in Microsoft PowerPoint allows a remote, unauthenticated attacker to trigger an out-of-bounds memory read by convincing a victim to open a specially crafted presentation file, potentially exposing heap contents that may contain sensitive data. Affected builds span Microsoft 365 Apps for Enterprise, Office 365 for Mac, and the Office LTSC 2021 and 2024 releases on both Windows and macOS. The attacker needs no credentials (PR:N), but the attack hinges entirely on user interaction (UI:R) - the document must be opened, and Protected View or Mark-of-the-Web handling for externally sourced files can interrupt the chain. Microsoft has released a vendor patch and no public exploit code or active exploitation has been identified at time of analysis.
Opening a specially crafted PowerPoint document in an unpatched Microsoft Office build can trigger an out-of-bounds read that leaks the contents of process memory to the attacker. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and the corresponding Office for Mac / LTSC for Mac 2021 and 2024 clients; exploitation is remote and needs no credentials (AV:N/PR:N) but hinges entirely on user interaction (UI:R), since the victim must open or preview the malicious file. The result is read-only memory disclosure (C:H, I:N, A:N) rather than code execution or data tampering, and there is no public exploit identified at time of analysis, though a vendor patch is available per the Microsoft Security Response Center advisory.
An out-of-bounds read in Microsoft Word (CWE-125) lets remote, unauthenticated attackers disclose the contents of process memory when a victim opens a specially crafted document, with affected builds spanning Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC 2021/2024, and Office LTSC for Mac 2021/2024. Exploitation requires the user to open the malicious file (UI:R) and deliver it successfully through social engineering, so it is not a zero-click or wormable flaw, and the impact is limited to information disclosure (C:H, I:N, A:N) without code execution or persistence. No public exploit code has been identified at time of analysis, and Microsoft has published a vendor patch through its update guide.
Information disclosure in Microsoft Word (and the broader Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021/2024 families) allows a remote attacker to read memory contents from the affected application by convincing a victim to open a specially crafted document. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N): the attacker needs no authentication, but exploitation hinges on user interaction - the target must open the malicious file - so delivery depends on phishing or social engineering rather than automatic remote compromise. Impact is limited to confidentiality (no code execution, integrity, or availability effect) and remains confined to the vulnerable process; there is no public exploit identified at time of analysis and no evidence of confirmed active exploitation, though the disclosure of high-value memory contents can still expose sensitive document data or session material. Microsoft has published a vendor patch via its MSRC update guide.
An out-of-bounds read in Microsoft Word (CVE-2026-108434, CVSS 6.5) allows a remote, unauthenticated attacker to disclose information from process memory if the victim opens or previews a specially crafted Word document. Affected builds are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and Office LTSC for Mac 2021/2024 plus Office 365 for Mac, per the vendor CPE list. Because the vector requires user interaction (UI:R) and the impact is limited to confidentiality (C:H with I:N/A:N), there is no zero-click or server-side exploitation path; Microsoft has published a fix through its MSRC update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a moderate-priority patching item rather than an emergency.
Memory parsing across Microsoft Office and SharePoint Server products is susceptible to a CWE-125 out-of-bounds read that, when triggered by opening a specially crafted Office document, produces local information disclosure or application availability loss. The affected surface is broad - spanning Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024 on both Windows and macOS, and SharePoint Enterprise Server 2016, 2019, and Subscription Edition - but real-world exploitation pressure is low: EPSS sits at 0.36% (28th percentile), CISA SSVC rates exploitation as none and the attack as non-automatable, and no public exploit has been identified at time of analysis. Vendor-released patches are available for all affected product lines.
Out-of-bounds read in Microsoft Office exposes sensitive memory contents to a local, unauthenticated attacker who can induce a user to open a malicious document. Affected products span the full current Office portfolio - Office 2016 through LTSC 2024 on both Windows and macOS - making the blast radius broad despite the local attack vector. No public exploit identified at time of analysis and SSVC classifies exploitation as none and not automatable, though the high confidentiality impact (C:H) and near-universal deployment of Office keep this a meaningful patching priority.
Out-of-bounds read in Microsoft Office and SharePoint exposes process memory contents locally when a user opens a specially crafted document. Affected products span the full Office suite - Office 2016, 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise (Windows and Mac), and SharePoint Server 2016, 2019, and Subscription Edition - covering virtually the entire active Office install base. No public exploit code exists and CISA SSVC rates exploitation as none, making this a patch-and-monitor priority rather than an emergency response.
Information disclosure in Microsoft Office (Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and Office for Mac) arises from an out-of-bounds read (CWE-125) that lets an attacker who convinces a victim to open a crafted file read memory beyond an intended buffer boundary. Exploitation is local and requires user interaction, and there is no public exploit identified at time of analysis and no CISA KEV listing. Disclosed memory can leak sensitive data such as heap contents or pointer addresses useful for defeating ASLR in a follow-on exploit chain.
Out-of-bounds read in Microsoft Office exposes a limited portion of process memory to a local attacker when a user opens a specially crafted document. Affected products span Office 2016 through LTSC 2024 on both Windows and macOS, with impact confined to low-severity information disclosure and no integrity or availability consequence. No public exploit code exists and CISA has not listed this in KEV; SSVC confirms exploitation status as none and the vulnerability is assessed as non-automatable, collectively placing this in the lowest real-world risk tier despite broad product coverage.
Uninitialized memory disclosure in Microsoft Office exposes sensitive data locally when a user interacts with a crafted document. The vulnerability, rooted in CWE-908 (Use of Uninitialized Resource), affects the full breadth of current Office deployments across Windows and macOS, including Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise. No public exploit code has been identified at time of analysis, and SSVC signals confirm no observed exploitation; however, the High confidentiality impact warrants prompt patching given Office's ubiquitous deployment footprint.
Numeric truncation error (CWE-197) in Microsoft Office Word triggers local information disclosure when a user opens a maliciously crafted document, exposing potentially sensitive memory contents with high confidentiality impact (C:H). The vulnerability spans a broad range of Microsoft Office and SharePoint products - including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Word 2016, Office 2019, Office 365 for Mac, and multiple SharePoint Server versions. No public exploit identified at time of analysis; CISA SSVC rates exploitation as none, EPSS stands at 0.39% (31st percentile), and a vendor-released patch is available from Microsoft.
Microsoft Office information disclosure via integer overflow (CWE-190) exposes high-confidentiality data to a local attacker who can induce a victim to open a crafted document. The flaw affects a broad range of Microsoft Office versions on both Windows and macOS - including Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise - confirmed by Microsoft via MSRC. No public exploit code exists and CISA SSVC rates exploitation as none, placing this in low urgency despite the High confidentiality impact in the CVSS vector; however, the extensive product footprint means patching remains advisable.
Out-of-bounds read in Microsoft Excel's file parser discloses sensitive memory contents when a victim opens a specially crafted workbook, affecting Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC for Mac 2021/2024, and Office Online Server. The CVSS vector (AV:N/PR:N/UI:R/C:H) indicates unauthenticated network delivery with mandatory user interaction and high confidentiality impact. No public exploit identified at time of analysis; SSVC confirms no known active exploitation and EPSS at 0.64% (46th percentile) reflects below-average exploitation probability, positioning this as a targeted phishing risk rather than an opportunistic threat.
Out-of-bounds read in Microsoft Office (including 365 Apps for Enterprise, Office 2016/2019, LTSC 2021/2024 on Windows and macOS, and SharePoint Server 2016/2019/Subscription Edition) allows a local attacker to disclose limited memory contents when a victim opens a specially crafted document. The CVSS 3.3 Low score, EPSS of 0.51% (40th percentile), SSVC exploitation status of 'none,' and absence from CISA KEV collectively place this vulnerability at low real-world priority despite its broad product footprint. No public exploit or proof-of-concept code has been identified at time of analysis.
Information disclosure in Microsoft Office Word and related Microsoft 365/SharePoint products exposes sensitive memory contents when a user opens a specially crafted document. Affecting a broad suite of products spanning Word 2016 through Office LTSC 2024 and SharePoint Server versions, the flaw stems from improper input type validation (CWE-1287) in the document parsing subsystem. No public exploit has been identified at time of analysis; EPSS at 0.39% and CISA SSVC exploitation status of 'none' confirm this remains a theoretical rather than actively targeted risk, though Microsoft has released patches.
Untrusted pointer dereference (CWE-822) in Microsoft Excel allows a local attacker to disclose sensitive memory contents when a victim opens a specially crafted workbook. The flaw affects a broad swath of Microsoft Office product lines - from Excel 2016 through Office LTSC 2024 and their Mac counterparts - as confirmed by CPE enumeration. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates exploitation as none and technical impact as partial, placing this in the moderate real-world priority tier despite the C:H CVSS rating.
Out-of-bounds read in Microsoft Office Word and associated Microsoft 365 products allows local information disclosure when a user opens a specially crafted document. Affecting a broad range of Microsoft Office versions across Windows and macOS - including Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365 for Mac, and SharePoint Server 2016/2019/Subscription Edition - an attacker with no prior system privileges must socially engineer a victim into opening a malicious file to trigger memory disclosure. No public exploit identified at time of analysis; EPSS is 0.39% (31st percentile) and SSVC confirms exploitation status as none and the attack as non-automatable.
Out-of-bounds read in Microsoft Office exposes high-confidentiality memory contents to a local, unauthenticated attacker who can induce a user to open a crafted document. The flaw affects a wide swath of Office and SharePoint products across Windows and Mac platforms, including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, Office 365 for Mac, and SharePoint Server 2016 through the Subscription Edition. No public exploit has been identified at time of analysis, EPSS is low at 0.50% (39th percentile), and CISA SSVC rates exploitation as none and the flaw as non-automatable, placing this firmly in a patch-and-monitor risk tier rather than an emergency-response tier.
Out-of-bounds memory read in Microsoft Office and SharePoint exposes sensitive in-process data when a user opens a specially crafted document on a local machine. Affecting Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024 (Windows and macOS), and SharePoint Server 2016 through Subscription Edition, the CWE-125 flaw allows an unauthorized attacker to read beyond allocated buffer boundaries, achieving High confidentiality impact with no integrity or availability consequence. No public exploit exists and no active exploitation is confirmed at time of analysis - CISA SSVC rates exploitation status as none - making this a routine-priority patch despite the broad product coverage.
Out-of-bounds read in Microsoft Office and SharePoint Server exposes local memory contents to an unauthorized attacker, resulting in information disclosure. The vulnerability (CWE-125) is triggered when a user opens a specially crafted Office document, making exploitation dependent on user interaction rather than remote network access. No active exploitation has been confirmed - CISA KEV does not list this CVE, SSVC rates exploitation as none, and EPSS probability sits at 0.51% (40th percentile), collectively indicating low real-world threat activity despite the wide deployment footprint of affected products.
Local information disclosure in Microsoft Office and SharePoint via an integer overflow (CWE-190) exposes sensitive data to low-privileged local attackers across a broad range of Office versions on both Windows and Mac platforms. The CVSS vector (AV:L/PR:L) confirms exploitation requires an existing foothold on the target machine, limiting real-world impact to post-compromise scenarios or insider threats. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.40% (32nd percentile) combined with SSVC exploitation status of 'none' indicates this is not currently being weaponized in the wild.
Out-of-bounds read (CWE-125) in Microsoft Office's file parsing logic exposes potentially sensitive in-memory data to a local attacker when a victim opens a specially crafted document, affecting Windows and macOS Office editions as well as Microsoft SharePoint Server. The CVSS 5.5 Medium score reflects a local-only attack vector with mandatory user interaction, confining impact to information disclosure with no integrity or availability consequence. No public exploit code exists, CISA SSVC classifies exploitation as 'none' with no automation potential, and the EPSS of 0.51% (40th percentile) confirms low current exploitation probability.
Out-of-bounds read in Microsoft Excel's file parsing engine exposes sensitive memory contents when a victim opens a specially crafted workbook, affecting Excel 2016 through Office LTSC 2024 and Office Online Server across both Windows and macOS platforms. The CVSS vector (AV:L/UI:R/C:H/I:N/A:N) confirms impact is limited to confidentiality loss - no code execution results - and requires local user interaction to trigger. No public exploit has been identified and CISA has not listed this in KEV; with an EPSS of 0.46% and SSVC exploitation status of none, this is appropriate for standard patch cycle prioritization rather than emergency response.
Out-of-bounds read in Microsoft Excel and related Office products exposes adjacent process memory to local information disclosure when a user opens a specially crafted spreadsheet file. The flaw spans a broad set of Microsoft Office versions across Windows and macOS - including Excel 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office Online Server - with vendor-released patches now available for all affected builds. No active exploitation has been confirmed by CISA KEV, and EPSS places exploitation probability at 0.35% (27th percentile), consistent with SSVC's assessment of no current exploitation and non-automatable delivery.
Untrusted pointer dereference in Microsoft Excel exposes sensitive in-process memory to a local attacker across virtually the entire Office product family - Excel 2016 through Office LTSC 2024 on Windows and macOS, plus Office Online Server. An attacker must deliver a crafted spreadsheet and induce the victim to open it; successful exploitation yields high confidentiality impact with no integrity or availability effect. No public exploit code or active exploitation has been identified; EPSS at 0.46% (37th percentile) and SSVC exploitation status of 'none' are consistent with low real-world risk at this time.
Information disclosure in Microsoft Office (Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and Office for Mac) via an out-of-bounds read (CWE-125) lets an attacker leak sensitive memory contents when a victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.1 (AV:L/AC:L/PR:N/UI:R), reflecting local exploitation that requires user interaction but no prior authentication. Microsoft is the reporting source and has published a fix; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Out-of-bounds read in Microsoft Excel's spreadsheet parser (CWE-125) exposes affected systems to both local information disclosure and application crash when a victim opens a specially crafted file, spanning Excel 2016 through Office LTSC 2024 and Office 365 for Mac. The CVSS vector (AV:L/UI:R/A:H) reveals that while the CVE description emphasizes information disclosure, the primary real-world impact is application availability - the invalid memory read can crash Excel (A:H), with incidental memory content leakage (C:L) as a secondary effect. No public exploit code has been identified at time of analysis and CISA SSVC assigns exploitation status of none, consistent with a low EPSS score of 0.31% at the 23rd percentile.
Heap-based buffer overflow in Microsoft Office Excel triggers a local information disclosure when a target user opens a maliciously crafted document. Affecting Excel 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS, the vulnerability yields only limited confidentiality impact (C:L) with no integrity or availability consequence, placing it in the Low severity tier at CVSS 3.3. No public exploit code exists and no active exploitation has been confirmed - CISA's SSVC framework rates exploitation as none, automatable as no, and technical impact as partial, consistent with the low EPSS probability of 0.27% (19th percentile).
External control of file name or path (CWE-73) in Microsoft Office Word enables network-based information disclosure when a victim opens a specially crafted document, affecting Word 2016, Office 2019, LTSC 2021/2024, and Microsoft 365 Apps for Enterprise. An unauthenticated remote attacker can exploit this to coerce Word into resolving an attacker-controlled file path - likely a UNC path - causing an outbound network request that leaks sensitive data such as NTLM credentials. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.05% at the 14th percentile indicates negligible real-world exploitation activity at time of analysis.
Local file disclosure in Microsoft Word exposes sensitive files and directories to external parties when a victim opens a specially crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise across version ranges confirmed by NVD CPE data. No public exploit code has been identified and CISA SSVC rates exploitation as none with only partial technical impact; a vendor-released patch is available via the Microsoft Security Response Center.