Microsoft Word 2016
Monthly
Information disclosure via improper input validation in Microsoft Office Word enables unauthenticated remote attackers to extract sensitive data across a broad product surface spanning Word 2016, Office 2019, multiple LTSC releases, and Microsoft 365 Apps for Enterprise on both Windows and macOS. The vendor-assigned CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no user interaction is required, though SSVC's 'Automatable: no' designation creates measurable tension with that assessment. No public exploit has been identified at time of analysis, and EPSS at 0.54% (43rd percentile) reflects low near-term exploitation probability despite the CVSS 7.5 rating.
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-based buffer overflow triggered when a victim opens a maliciously crafted document. An attacker who convinces a user to open a booby-trapped file can run arbitrary code in that user's context, achieving full compromise of confidentiality, integrity, and availability on the host. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, though a vendor patch is available per Microsoft's MSRC advisory.
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary code in the context of the current user when a victim opens a maliciously crafted document. The flaw affects a broad Office footprint including Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024 (Windows and Mac), and related SharePoint Server products that process Word documents. Microsoft has released a patch; no public exploit has been identified at time of analysis, and neither KEV nor EPSS/POC signals were provided in the input.
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS builds) arises from a stack-based buffer overflow triggered when a victim opens a maliciously crafted document. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) shows an unauthenticated attacker needs no privileges but does require user interaction, and successful exploitation yields full confidentiality, integrity, and availability impact in the user's security context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft has released a patch.
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for Mac) stems from a double free of heap memory (CWE-415) that lets an unauthorized attacker run arbitrary code when a victim opens a malicious document. The flaw was reported by Microsoft, carries CVSS 7.8, and a vendor patch is available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because exploitation requires the target to open a crafted file (UI:R), it is a user-interaction-gated client-side RCE rather than a remotely-triggerable service bug.
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-based buffer overflow (CWE-121) that an attacker triggers when a victim opens a maliciously crafted document. The CVSS 3.1 vector (AV:L/UI:R) confirms this is a file-borne, local-context flaw requiring the user to open attacker-supplied content, yielding full confidentiality, integrity, and availability impact in the user's session. No public exploit identified at time of analysis, and it is not listed in CISA KEV; Microsoft has released a patch via MSRC.
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrary code in the context of the user who opens a maliciously crafted document. The flaw affects Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024 (including Mac editions), and the Word component shared with SharePoint Server 2016/2019/Subscription Edition. No public exploit identified at time of analysis, and it is not listed in CISA KEV; exploitation requires the victim to open the attacker's file (UI:R).
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized attacker run arbitrary code when a victim opens a maliciously crafted Word document that triggers a heap-based buffer overflow. All impacted SKUs - Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, the macOS Office builds, and SharePoint Server (which renders Office documents server-side) - are affected, and Microsoft has released a patch. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer overflow in the file-parsing path, letting an attacker who convinces a victim to open a crafted document run arbitrary code with the victim's privileges. It affects a broad Office footprint including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, the macOS editions, and SharePoint Server 2016/2019/Subscription Edition. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 7.8 CVSS and Word's ubiquity make it a routine priority patch.
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, and Word 2016) allows an attacker to run arbitrary code by exploiting a use-after-free memory corruption flaw when a victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.8 with a local attack vector requiring user interaction; there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. Microsoft, which reported the issue itself, has released a patch.
Local code execution in Microsoft Word (and Office 2016/2019, LTSC 2021/2024, 365 Apps, Office for Mac, and SharePoint Server) stems from an untrusted pointer dereference (CWE-822) that lets an attacker run arbitrary code with the victim's privileges when a malicious file is processed. Microsoft rates it CVSS 8.4 with total technical impact (high confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC marks exploitation as none and not automatable, indicating no observed real-world attacks yet.
Local code execution in Microsoft Office Word (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, and Office LTSC for Mac 2021/2024) arises from a use-after-free memory-corruption flaw that lets an attacker run arbitrary code in the context of the user who opens a maliciously crafted document. Microsoft has released a patch, and no public exploit has been identified at time of analysis; EPSS is very low at 0.06% (18th percentile) and CISA SSVC records no known exploitation.
Local code execution in Microsoft Word (and the Office suites that bundle it - Office 2016/2019, LTSC 2021/2024, Microsoft 365 Apps, and Office LTSC for Mac 2021/2024) stems from a use-after-free memory-corruption defect that lets an attacker run arbitrary code in the context of the current user, typically by having the victim process a crafted document. Microsoft (the reporting party) has released a fix; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 14th percentile). SSVC rates exploitation as none but technical impact as total, so this is a patch-on-schedule item rather than an emergency.
Local code execution in Microsoft Word (Office 2016 through Office LTSC 2024, Microsoft 365 Apps, and Office for Mac) results from a type-confusion flaw (CWE-843) that lets an unauthorized attacker run arbitrary code with the victim's privileges. Microsoft rates it CVSS 8.4 with total technical impact, but there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 35th percentile). CISA SSVC records exploitation status as none and the issue is not automatable, indicating no observed in-the-wild activity.
Numeric truncation error (CWE-197) in Microsoft Office Word triggers local information disclosure when a user opens a maliciously crafted document, exposing potentially sensitive memory contents with high confidentiality impact (C:H). The vulnerability spans a broad range of Microsoft Office and SharePoint products - including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Word 2016, Office 2019, Office 365 for Mac, and multiple SharePoint Server versions. No public exploit identified at time of analysis; CISA SSVC rates exploitation as none, EPSS stands at 0.39% (31st percentile), and a vendor-released patch is available from Microsoft.
Information disclosure in Microsoft Office Word and related Microsoft 365/SharePoint products exposes sensitive memory contents when a user opens a specially crafted document. Affecting a broad suite of products spanning Word 2016 through Office LTSC 2024 and SharePoint Server versions, the flaw stems from improper input type validation (CWE-1287) in the document parsing subsystem. No public exploit has been identified at time of analysis; EPSS at 0.39% and CISA SSVC exploitation status of 'none' confirm this remains a theoretical rather than actively targeted risk, though Microsoft has released patches.
Out-of-bounds read in Microsoft Office Word and associated Microsoft 365 products allows local information disclosure when a user opens a specially crafted document. Affecting a broad range of Microsoft Office versions across Windows and macOS - including Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365 for Mac, and SharePoint Server 2016/2019/Subscription Edition - an attacker with no prior system privileges must socially engineer a victim into opening a malicious file to trigger memory disclosure. No public exploit identified at time of analysis; EPSS is 0.39% (31st percentile) and SSVC confirms exploitation status as none and the attack as non-automatable.
External control of file name or path (CWE-73) in Microsoft Office Word enables network-based information disclosure when a victim opens a specially crafted document, affecting Word 2016, Office 2019, LTSC 2021/2024, and Microsoft 365 Apps for Enterprise. An unauthenticated remote attacker can exploit this to coerce Word into resolving an attacker-controlled file path - likely a UNC path - causing an outbound network request that leaks sensitive data such as NTLM credentials. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.05% at the 14th percentile indicates negligible real-world exploitation activity at time of analysis.
Local file disclosure in Microsoft Word exposes sensitive files and directories to external parties when a victim opens a specially crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise across version ranges confirmed by NVD CPE data. No public exploit code has been identified and CISA SSVC rates exploitation as none with only partial technical impact; a vendor-released patch is available via the Microsoft Security Response Center.
Information disclosure via improper input validation in Microsoft Office Word enables unauthenticated remote attackers to extract sensitive data across a broad product surface spanning Word 2016, Office 2019, multiple LTSC releases, and Microsoft 365 Apps for Enterprise on both Windows and macOS. The vendor-assigned CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no user interaction is required, though SSVC's 'Automatable: no' designation creates measurable tension with that assessment. No public exploit has been identified at time of analysis, and EPSS at 0.54% (43rd percentile) reflects low near-term exploitation probability despite the CVSS 7.5 rating.
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-based buffer overflow triggered when a victim opens a maliciously crafted document. An attacker who convinces a user to open a booby-trapped file can run arbitrary code in that user's context, achieving full compromise of confidentiality, integrity, and availability on the host. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, though a vendor patch is available per Microsoft's MSRC advisory.
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary code in the context of the current user when a victim opens a maliciously crafted document. The flaw affects a broad Office footprint including Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024 (Windows and Mac), and related SharePoint Server products that process Word documents. Microsoft has released a patch; no public exploit has been identified at time of analysis, and neither KEV nor EPSS/POC signals were provided in the input.
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS builds) arises from a stack-based buffer overflow triggered when a victim opens a maliciously crafted document. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) shows an unauthenticated attacker needs no privileges but does require user interaction, and successful exploitation yields full confidentiality, integrity, and availability impact in the user's security context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft has released a patch.
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for Mac) stems from a double free of heap memory (CWE-415) that lets an unauthorized attacker run arbitrary code when a victim opens a malicious document. The flaw was reported by Microsoft, carries CVSS 7.8, and a vendor patch is available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because exploitation requires the target to open a crafted file (UI:R), it is a user-interaction-gated client-side RCE rather than a remotely-triggerable service bug.
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-based buffer overflow (CWE-121) that an attacker triggers when a victim opens a maliciously crafted document. The CVSS 3.1 vector (AV:L/UI:R) confirms this is a file-borne, local-context flaw requiring the user to open attacker-supplied content, yielding full confidentiality, integrity, and availability impact in the user's session. No public exploit identified at time of analysis, and it is not listed in CISA KEV; Microsoft has released a patch via MSRC.
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrary code in the context of the user who opens a maliciously crafted document. The flaw affects Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024 (including Mac editions), and the Word component shared with SharePoint Server 2016/2019/Subscription Edition. No public exploit identified at time of analysis, and it is not listed in CISA KEV; exploitation requires the victim to open the attacker's file (UI:R).
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized attacker run arbitrary code when a victim opens a maliciously crafted Word document that triggers a heap-based buffer overflow. All impacted SKUs - Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, the macOS Office builds, and SharePoint Server (which renders Office documents server-side) - are affected, and Microsoft has released a patch. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer overflow in the file-parsing path, letting an attacker who convinces a victim to open a crafted document run arbitrary code with the victim's privileges. It affects a broad Office footprint including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, the macOS editions, and SharePoint Server 2016/2019/Subscription Edition. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 7.8 CVSS and Word's ubiquity make it a routine priority patch.
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, and Word 2016) allows an attacker to run arbitrary code by exploiting a use-after-free memory corruption flaw when a victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.8 with a local attack vector requiring user interaction; there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. Microsoft, which reported the issue itself, has released a patch.
Local code execution in Microsoft Word (and Office 2016/2019, LTSC 2021/2024, 365 Apps, Office for Mac, and SharePoint Server) stems from an untrusted pointer dereference (CWE-822) that lets an attacker run arbitrary code with the victim's privileges when a malicious file is processed. Microsoft rates it CVSS 8.4 with total technical impact (high confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC marks exploitation as none and not automatable, indicating no observed real-world attacks yet.
Local code execution in Microsoft Office Word (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, and Office LTSC for Mac 2021/2024) arises from a use-after-free memory-corruption flaw that lets an attacker run arbitrary code in the context of the user who opens a maliciously crafted document. Microsoft has released a patch, and no public exploit has been identified at time of analysis; EPSS is very low at 0.06% (18th percentile) and CISA SSVC records no known exploitation.
Local code execution in Microsoft Word (and the Office suites that bundle it - Office 2016/2019, LTSC 2021/2024, Microsoft 365 Apps, and Office LTSC for Mac 2021/2024) stems from a use-after-free memory-corruption defect that lets an attacker run arbitrary code in the context of the current user, typically by having the victim process a crafted document. Microsoft (the reporting party) has released a fix; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 14th percentile). SSVC rates exploitation as none but technical impact as total, so this is a patch-on-schedule item rather than an emergency.
Local code execution in Microsoft Word (Office 2016 through Office LTSC 2024, Microsoft 365 Apps, and Office for Mac) results from a type-confusion flaw (CWE-843) that lets an unauthorized attacker run arbitrary code with the victim's privileges. Microsoft rates it CVSS 8.4 with total technical impact, but there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 35th percentile). CISA SSVC records exploitation status as none and the issue is not automatable, indicating no observed in-the-wild activity.
Numeric truncation error (CWE-197) in Microsoft Office Word triggers local information disclosure when a user opens a maliciously crafted document, exposing potentially sensitive memory contents with high confidentiality impact (C:H). The vulnerability spans a broad range of Microsoft Office and SharePoint products - including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Word 2016, Office 2019, Office 365 for Mac, and multiple SharePoint Server versions. No public exploit identified at time of analysis; CISA SSVC rates exploitation as none, EPSS stands at 0.39% (31st percentile), and a vendor-released patch is available from Microsoft.
Information disclosure in Microsoft Office Word and related Microsoft 365/SharePoint products exposes sensitive memory contents when a user opens a specially crafted document. Affecting a broad suite of products spanning Word 2016 through Office LTSC 2024 and SharePoint Server versions, the flaw stems from improper input type validation (CWE-1287) in the document parsing subsystem. No public exploit has been identified at time of analysis; EPSS at 0.39% and CISA SSVC exploitation status of 'none' confirm this remains a theoretical rather than actively targeted risk, though Microsoft has released patches.
Out-of-bounds read in Microsoft Office Word and associated Microsoft 365 products allows local information disclosure when a user opens a specially crafted document. Affecting a broad range of Microsoft Office versions across Windows and macOS - including Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365 for Mac, and SharePoint Server 2016/2019/Subscription Edition - an attacker with no prior system privileges must socially engineer a victim into opening a malicious file to trigger memory disclosure. No public exploit identified at time of analysis; EPSS is 0.39% (31st percentile) and SSVC confirms exploitation status as none and the attack as non-automatable.
External control of file name or path (CWE-73) in Microsoft Office Word enables network-based information disclosure when a victim opens a specially crafted document, affecting Word 2016, Office 2019, LTSC 2021/2024, and Microsoft 365 Apps for Enterprise. An unauthenticated remote attacker can exploit this to coerce Word into resolving an attacker-controlled file path - likely a UNC path - causing an outbound network request that leaks sensitive data such as NTLM credentials. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.05% at the 14th percentile indicates negligible real-world exploitation activity at time of analysis.
Local file disclosure in Microsoft Word exposes sensitive files and directories to external parties when a victim opens a specially crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise across version ranges confirmed by NVD CPE data. No public exploit code has been identified and CISA SSVC rates exploitation as none with only partial technical impact; a vendor-released patch is available via the Microsoft Security Response Center.