Microsoft Office Ltsc For Mac 2024
Monthly
Out-of-bounds read in Microsoft Office exposes a limited portion of process memory to a local attacker when a user opens a specially crafted document. Affected products span Office 2016 through LTSC 2024 on both Windows and macOS, with impact confined to low-severity information disclosure and no integrity or availability consequence. No public exploit code exists and CISA has not listed this in KEV; SSVC confirms exploitation status as none and the vulnerability is assessed as non-automatable, collectively placing this in the lowest real-world risk tier despite broad product coverage.
Uninitialized memory disclosure in Microsoft Office exposes sensitive data locally when a user interacts with a crafted document. The vulnerability, rooted in CWE-908 (Use of Uninitialized Resource), affects the full breadth of current Office deployments across Windows and macOS, including Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise. No public exploit code has been identified at time of analysis, and SSVC signals confirm no observed exploitation; however, the High confidentiality impact warrants prompt patching given Office's ubiquitous deployment footprint.
Microsoft Office information disclosure via integer overflow (CWE-190) exposes high-confidentiality data to a local attacker who can induce a victim to open a crafted document. The flaw affects a broad range of Microsoft Office versions on both Windows and macOS - including Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise - confirmed by Microsoft via MSRC. No public exploit code exists and CISA SSVC rates exploitation as none, placing this in low urgency despite the High confidentiality impact in the CVSS vector; however, the extensive product footprint means patching remains advisable.
Out-of-bounds read in Microsoft Excel's file parser discloses sensitive memory contents when a victim opens a specially crafted workbook, affecting Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC for Mac 2021/2024, and Office Online Server. The CVSS vector (AV:N/PR:N/UI:R/C:H) indicates unauthenticated network delivery with mandatory user interaction and high confidentiality impact. No public exploit identified at time of analysis; SSVC confirms no known active exploitation and EPSS at 0.64% (46th percentile) reflects below-average exploitation probability, positioning this as a targeted phishing risk rather than an opportunistic threat.
Out-of-bounds read in Microsoft Office (including 365 Apps for Enterprise, Office 2016/2019, LTSC 2021/2024 on Windows and macOS, and SharePoint Server 2016/2019/Subscription Edition) allows a local attacker to disclose limited memory contents when a victim opens a specially crafted document. The CVSS 3.3 Low score, EPSS of 0.51% (40th percentile), SSVC exploitation status of 'none,' and absence from CISA KEV collectively place this vulnerability at low real-world priority despite its broad product footprint. No public exploit or proof-of-concept code has been identified at time of analysis.
Information disclosure in Microsoft Office Word and related Microsoft 365/SharePoint products exposes sensitive memory contents when a user opens a specially crafted document. Affecting a broad suite of products spanning Word 2016 through Office LTSC 2024 and SharePoint Server versions, the flaw stems from improper input type validation (CWE-1287) in the document parsing subsystem. No public exploit has been identified at time of analysis; EPSS at 0.39% and CISA SSVC exploitation status of 'none' confirm this remains a theoretical rather than actively targeted risk, though Microsoft has released patches.
Untrusted pointer dereference (CWE-822) in Microsoft Excel allows a local attacker to disclose sensitive memory contents when a victim opens a specially crafted workbook. The flaw affects a broad swath of Microsoft Office product lines - from Excel 2016 through Office LTSC 2024 and their Mac counterparts - as confirmed by CPE enumeration. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates exploitation as none and technical impact as partial, placing this in the moderate real-world priority tier despite the C:H CVSS rating.
Out-of-bounds read in Microsoft Office Word and associated Microsoft 365 products allows local information disclosure when a user opens a specially crafted document. Affecting a broad range of Microsoft Office versions across Windows and macOS - including Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365 for Mac, and SharePoint Server 2016/2019/Subscription Edition - an attacker with no prior system privileges must socially engineer a victim into opening a malicious file to trigger memory disclosure. No public exploit identified at time of analysis; EPSS is 0.39% (31st percentile) and SSVC confirms exploitation status as none and the attack as non-automatable.
Out-of-bounds read in Microsoft Office exposes high-confidentiality memory contents to a local, unauthenticated attacker who can induce a user to open a crafted document. The flaw affects a wide swath of Office and SharePoint products across Windows and Mac platforms, including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, Office 365 for Mac, and SharePoint Server 2016 through the Subscription Edition. No public exploit has been identified at time of analysis, EPSS is low at 0.50% (39th percentile), and CISA SSVC rates exploitation as none and the flaw as non-automatable, placing this firmly in a patch-and-monitor risk tier rather than an emergency-response tier.
Out-of-bounds memory read in Microsoft Office and SharePoint exposes sensitive in-process data when a user opens a specially crafted document on a local machine. Affecting Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024 (Windows and macOS), and SharePoint Server 2016 through Subscription Edition, the CWE-125 flaw allows an unauthorized attacker to read beyond allocated buffer boundaries, achieving High confidentiality impact with no integrity or availability consequence. No public exploit exists and no active exploitation is confirmed at time of analysis - CISA SSVC rates exploitation status as none - making this a routine-priority patch despite the broad product coverage.
Out-of-bounds read in Microsoft Office and SharePoint Server exposes local memory contents to an unauthorized attacker, resulting in information disclosure. The vulnerability (CWE-125) is triggered when a user opens a specially crafted Office document, making exploitation dependent on user interaction rather than remote network access. No active exploitation has been confirmed - CISA KEV does not list this CVE, SSVC rates exploitation as none, and EPSS probability sits at 0.51% (40th percentile), collectively indicating low real-world threat activity despite the wide deployment footprint of affected products.
Local information disclosure in Microsoft Office and SharePoint via an integer overflow (CWE-190) exposes sensitive data to low-privileged local attackers across a broad range of Office versions on both Windows and Mac platforms. The CVSS vector (AV:L/PR:L) confirms exploitation requires an existing foothold on the target machine, limiting real-world impact to post-compromise scenarios or insider threats. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.40% (32nd percentile) combined with SSVC exploitation status of 'none' indicates this is not currently being weaponized in the wild.
Out-of-bounds read (CWE-125) in Microsoft Office's file parsing logic exposes potentially sensitive in-memory data to a local attacker when a victim opens a specially crafted document, affecting Windows and macOS Office editions as well as Microsoft SharePoint Server. The CVSS 5.5 Medium score reflects a local-only attack vector with mandatory user interaction, confining impact to information disclosure with no integrity or availability consequence. No public exploit code exists, CISA SSVC classifies exploitation as 'none' with no automation potential, and the EPSS of 0.51% (40th percentile) confirms low current exploitation probability.
Out-of-bounds read in Microsoft Excel's file parsing engine exposes sensitive memory contents when a victim opens a specially crafted workbook, affecting Excel 2016 through Office LTSC 2024 and Office Online Server across both Windows and macOS platforms. The CVSS vector (AV:L/UI:R/C:H/I:N/A:N) confirms impact is limited to confidentiality loss - no code execution results - and requires local user interaction to trigger. No public exploit has been identified and CISA has not listed this in KEV; with an EPSS of 0.46% and SSVC exploitation status of none, this is appropriate for standard patch cycle prioritization rather than emergency response.
Out-of-bounds read in Microsoft Excel and related Office products exposes adjacent process memory to local information disclosure when a user opens a specially crafted spreadsheet file. The flaw spans a broad set of Microsoft Office versions across Windows and macOS - including Excel 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office Online Server - with vendor-released patches now available for all affected builds. No active exploitation has been confirmed by CISA KEV, and EPSS places exploitation probability at 0.35% (27th percentile), consistent with SSVC's assessment of no current exploitation and non-automatable delivery.
Untrusted pointer dereference in Microsoft Excel exposes sensitive in-process memory to a local attacker across virtually the entire Office product family - Excel 2016 through Office LTSC 2024 on Windows and macOS, plus Office Online Server. An attacker must deliver a crafted spreadsheet and induce the victim to open it; successful exploitation yields high confidentiality impact with no integrity or availability effect. No public exploit code or active exploitation has been identified; EPSS at 0.46% (37th percentile) and SSVC exploitation status of 'none' are consistent with low real-world risk at this time.
Information disclosure in Microsoft Office (Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and Office for Mac) via an out-of-bounds read (CWE-125) lets an attacker leak sensitive memory contents when a victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.1 (AV:L/AC:L/PR:N/UI:R), reflecting local exploitation that requires user interaction but no prior authentication. Microsoft is the reporting source and has published a fix; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Out-of-bounds read in Microsoft Excel's spreadsheet parser (CWE-125) exposes affected systems to both local information disclosure and application crash when a victim opens a specially crafted file, spanning Excel 2016 through Office LTSC 2024 and Office 365 for Mac. The CVSS vector (AV:L/UI:R/A:H) reveals that while the CVE description emphasizes information disclosure, the primary real-world impact is application availability - the invalid memory read can crash Excel (A:H), with incidental memory content leakage (C:L) as a secondary effect. No public exploit code has been identified at time of analysis and CISA SSVC assigns exploitation status of none, consistent with a low EPSS score of 0.31% at the 23rd percentile.
Heap-based buffer overflow in Microsoft Office Excel triggers a local information disclosure when a target user opens a maliciously crafted document. Affecting Excel 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS, the vulnerability yields only limited confidentiality impact (C:L) with no integrity or availability consequence, placing it in the Low severity tier at CVSS 3.3. No public exploit code exists and no active exploitation has been confirmed - CISA's SSVC framework rates exploitation as none, automatable as no, and technical impact as partial, consistent with the low EPSS probability of 0.27% (19th percentile).
Out-of-bounds read in Microsoft Office Word enables local information disclosure when a user opens a malicious document, affecting Microsoft 365 Apps for Enterprise and Office LTSC for Mac 2021/2024. The vulnerability requires user interaction (document opening) but does not require elevated privileges, with a CVSS score of 6.1 reflecting moderate severity. Microsoft has released patches addressing this issue across affected product lines.
Out-of-bounds read in Microsoft Office exposes a limited portion of process memory to a local attacker when a user opens a specially crafted document. Affected products span Office 2016 through LTSC 2024 on both Windows and macOS, with impact confined to low-severity information disclosure and no integrity or availability consequence. No public exploit code exists and CISA has not listed this in KEV; SSVC confirms exploitation status as none and the vulnerability is assessed as non-automatable, collectively placing this in the lowest real-world risk tier despite broad product coverage.
Uninitialized memory disclosure in Microsoft Office exposes sensitive data locally when a user interacts with a crafted document. The vulnerability, rooted in CWE-908 (Use of Uninitialized Resource), affects the full breadth of current Office deployments across Windows and macOS, including Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise. No public exploit code has been identified at time of analysis, and SSVC signals confirm no observed exploitation; however, the High confidentiality impact warrants prompt patching given Office's ubiquitous deployment footprint.
Microsoft Office information disclosure via integer overflow (CWE-190) exposes high-confidentiality data to a local attacker who can induce a victim to open a crafted document. The flaw affects a broad range of Microsoft Office versions on both Windows and macOS - including Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise - confirmed by Microsoft via MSRC. No public exploit code exists and CISA SSVC rates exploitation as none, placing this in low urgency despite the High confidentiality impact in the CVSS vector; however, the extensive product footprint means patching remains advisable.
Out-of-bounds read in Microsoft Excel's file parser discloses sensitive memory contents when a victim opens a specially crafted workbook, affecting Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC for Mac 2021/2024, and Office Online Server. The CVSS vector (AV:N/PR:N/UI:R/C:H) indicates unauthenticated network delivery with mandatory user interaction and high confidentiality impact. No public exploit identified at time of analysis; SSVC confirms no known active exploitation and EPSS at 0.64% (46th percentile) reflects below-average exploitation probability, positioning this as a targeted phishing risk rather than an opportunistic threat.
Out-of-bounds read in Microsoft Office (including 365 Apps for Enterprise, Office 2016/2019, LTSC 2021/2024 on Windows and macOS, and SharePoint Server 2016/2019/Subscription Edition) allows a local attacker to disclose limited memory contents when a victim opens a specially crafted document. The CVSS 3.3 Low score, EPSS of 0.51% (40th percentile), SSVC exploitation status of 'none,' and absence from CISA KEV collectively place this vulnerability at low real-world priority despite its broad product footprint. No public exploit or proof-of-concept code has been identified at time of analysis.
Information disclosure in Microsoft Office Word and related Microsoft 365/SharePoint products exposes sensitive memory contents when a user opens a specially crafted document. Affecting a broad suite of products spanning Word 2016 through Office LTSC 2024 and SharePoint Server versions, the flaw stems from improper input type validation (CWE-1287) in the document parsing subsystem. No public exploit has been identified at time of analysis; EPSS at 0.39% and CISA SSVC exploitation status of 'none' confirm this remains a theoretical rather than actively targeted risk, though Microsoft has released patches.
Untrusted pointer dereference (CWE-822) in Microsoft Excel allows a local attacker to disclose sensitive memory contents when a victim opens a specially crafted workbook. The flaw affects a broad swath of Microsoft Office product lines - from Excel 2016 through Office LTSC 2024 and their Mac counterparts - as confirmed by CPE enumeration. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates exploitation as none and technical impact as partial, placing this in the moderate real-world priority tier despite the C:H CVSS rating.
Out-of-bounds read in Microsoft Office Word and associated Microsoft 365 products allows local information disclosure when a user opens a specially crafted document. Affecting a broad range of Microsoft Office versions across Windows and macOS - including Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365 for Mac, and SharePoint Server 2016/2019/Subscription Edition - an attacker with no prior system privileges must socially engineer a victim into opening a malicious file to trigger memory disclosure. No public exploit identified at time of analysis; EPSS is 0.39% (31st percentile) and SSVC confirms exploitation status as none and the attack as non-automatable.
Out-of-bounds read in Microsoft Office exposes high-confidentiality memory contents to a local, unauthenticated attacker who can induce a user to open a crafted document. The flaw affects a wide swath of Office and SharePoint products across Windows and Mac platforms, including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, Office 365 for Mac, and SharePoint Server 2016 through the Subscription Edition. No public exploit has been identified at time of analysis, EPSS is low at 0.50% (39th percentile), and CISA SSVC rates exploitation as none and the flaw as non-automatable, placing this firmly in a patch-and-monitor risk tier rather than an emergency-response tier.
Out-of-bounds memory read in Microsoft Office and SharePoint exposes sensitive in-process data when a user opens a specially crafted document on a local machine. Affecting Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024 (Windows and macOS), and SharePoint Server 2016 through Subscription Edition, the CWE-125 flaw allows an unauthorized attacker to read beyond allocated buffer boundaries, achieving High confidentiality impact with no integrity or availability consequence. No public exploit exists and no active exploitation is confirmed at time of analysis - CISA SSVC rates exploitation status as none - making this a routine-priority patch despite the broad product coverage.
Out-of-bounds read in Microsoft Office and SharePoint Server exposes local memory contents to an unauthorized attacker, resulting in information disclosure. The vulnerability (CWE-125) is triggered when a user opens a specially crafted Office document, making exploitation dependent on user interaction rather than remote network access. No active exploitation has been confirmed - CISA KEV does not list this CVE, SSVC rates exploitation as none, and EPSS probability sits at 0.51% (40th percentile), collectively indicating low real-world threat activity despite the wide deployment footprint of affected products.
Local information disclosure in Microsoft Office and SharePoint via an integer overflow (CWE-190) exposes sensitive data to low-privileged local attackers across a broad range of Office versions on both Windows and Mac platforms. The CVSS vector (AV:L/PR:L) confirms exploitation requires an existing foothold on the target machine, limiting real-world impact to post-compromise scenarios or insider threats. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.40% (32nd percentile) combined with SSVC exploitation status of 'none' indicates this is not currently being weaponized in the wild.
Out-of-bounds read (CWE-125) in Microsoft Office's file parsing logic exposes potentially sensitive in-memory data to a local attacker when a victim opens a specially crafted document, affecting Windows and macOS Office editions as well as Microsoft SharePoint Server. The CVSS 5.5 Medium score reflects a local-only attack vector with mandatory user interaction, confining impact to information disclosure with no integrity or availability consequence. No public exploit code exists, CISA SSVC classifies exploitation as 'none' with no automation potential, and the EPSS of 0.51% (40th percentile) confirms low current exploitation probability.
Out-of-bounds read in Microsoft Excel's file parsing engine exposes sensitive memory contents when a victim opens a specially crafted workbook, affecting Excel 2016 through Office LTSC 2024 and Office Online Server across both Windows and macOS platforms. The CVSS vector (AV:L/UI:R/C:H/I:N/A:N) confirms impact is limited to confidentiality loss - no code execution results - and requires local user interaction to trigger. No public exploit has been identified and CISA has not listed this in KEV; with an EPSS of 0.46% and SSVC exploitation status of none, this is appropriate for standard patch cycle prioritization rather than emergency response.
Out-of-bounds read in Microsoft Excel and related Office products exposes adjacent process memory to local information disclosure when a user opens a specially crafted spreadsheet file. The flaw spans a broad set of Microsoft Office versions across Windows and macOS - including Excel 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office Online Server - with vendor-released patches now available for all affected builds. No active exploitation has been confirmed by CISA KEV, and EPSS places exploitation probability at 0.35% (27th percentile), consistent with SSVC's assessment of no current exploitation and non-automatable delivery.
Untrusted pointer dereference in Microsoft Excel exposes sensitive in-process memory to a local attacker across virtually the entire Office product family - Excel 2016 through Office LTSC 2024 on Windows and macOS, plus Office Online Server. An attacker must deliver a crafted spreadsheet and induce the victim to open it; successful exploitation yields high confidentiality impact with no integrity or availability effect. No public exploit code or active exploitation has been identified; EPSS at 0.46% (37th percentile) and SSVC exploitation status of 'none' are consistent with low real-world risk at this time.
Information disclosure in Microsoft Office (Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and Office for Mac) via an out-of-bounds read (CWE-125) lets an attacker leak sensitive memory contents when a victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.1 (AV:L/AC:L/PR:N/UI:R), reflecting local exploitation that requires user interaction but no prior authentication. Microsoft is the reporting source and has published a fix; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Out-of-bounds read in Microsoft Excel's spreadsheet parser (CWE-125) exposes affected systems to both local information disclosure and application crash when a victim opens a specially crafted file, spanning Excel 2016 through Office LTSC 2024 and Office 365 for Mac. The CVSS vector (AV:L/UI:R/A:H) reveals that while the CVE description emphasizes information disclosure, the primary real-world impact is application availability - the invalid memory read can crash Excel (A:H), with incidental memory content leakage (C:L) as a secondary effect. No public exploit code has been identified at time of analysis and CISA SSVC assigns exploitation status of none, consistent with a low EPSS score of 0.31% at the 23rd percentile.
Heap-based buffer overflow in Microsoft Office Excel triggers a local information disclosure when a target user opens a maliciously crafted document. Affecting Excel 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS, the vulnerability yields only limited confidentiality impact (C:L) with no integrity or availability consequence, placing it in the Low severity tier at CVSS 3.3. No public exploit code exists and no active exploitation has been confirmed - CISA's SSVC framework rates exploitation as none, automatable as no, and technical impact as partial, consistent with the low EPSS probability of 0.27% (19th percentile).
Out-of-bounds read in Microsoft Office Word enables local information disclosure when a user opens a malicious document, affecting Microsoft 365 Apps for Enterprise and Office LTSC for Mac 2021/2024. The vulnerability requires user interaction (document opening) but does not require elevated privileges, with a CVSS score of 6.1 reflecting moderate severity. Microsoft has released patches addressing this issue across affected product lines.