Office Online Server
Monthly
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. [CVSS 7.8 HIGH]
Information disclosure in Microsoft Excel allows unauthenticated remote attackers to read sensitive memory contents by enticing a user to open a specially crafted Excel document. The flaw affects multiple Microsoft Office products, including Office LTSC 2024, Office LTSC 2021, Office Online Server, and Microsoft 365 Apps, and requires user interaction (opening or previewing the file) for exploitation. No public exploit code has been identified, and CISA SSVC rates exploitation as none; the risk is considered a moderate-priority information-disclosure issue.
Out-of-bounds read in Microsoft Excel allows an unauthenticated remote attacker to disclose confidential process memory, but only when a targeted user opens a maliciously crafted Excel file. No public exploit or active exploitation has been identified (CISA SSVC exploitation: none, automatable: no), and the EPSS score was not provided at the time of analysis. The flaw carries a moderate CVSS 6.5 with confidentiality impact only; vendor-released patches are available.
Information disclosure in Microsoft Office Excel allows an unauthenticated attacker to read sensitive system data when a victim opens a crafted spreadsheet. Affected builds include Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, Office for Mac 2021/2024, Office 365 for Mac, and Office Online Server before 16.0.10417.20228. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), exploitation requires user interaction, and no public exploit or active exploitation has been identified at time of analysis; vendor patches are available.
Type confusion (CWE-843) in Microsoft Office Excel enables local information disclosure when a victim opens a specially crafted Excel file. Affected products span Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and multiple Mac Office variants. The vulnerability carries a CVSS 5.5 with High confidentiality impact but no integrity or availability impact; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in Microsoft Office Excel's file parser allows local information disclosure when a victim opens a specially crafted workbook. Affecting Excel 2016 through Microsoft 365 Apps for Enterprise, Office LTSC 2024, Office Online Server, and multiple macOS Office variants, the vulnerability (CWE-125) exposes process memory with high confidentiality impact but no integrity or availability consequences. Microsoft has released patched builds via MSRC; SSVC confirms no active exploitation and non-automatable delivery, placing this squarely within standard monthly patch-cycle priority.
Out-of-bounds read in Microsoft Excel's file parser discloses sensitive memory contents when a victim opens a specially crafted workbook, affecting Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC for Mac 2021/2024, and Office Online Server. The CVSS vector (AV:N/PR:N/UI:R/C:H) indicates unauthenticated network delivery with mandatory user interaction and high confidentiality impact. No public exploit identified at time of analysis; SSVC confirms no known active exploitation and EPSS at 0.64% (46th percentile) reflects below-average exploitation probability, positioning this as a targeted phishing risk rather than an opportunistic threat.
Untrusted pointer dereference (CWE-822) in Microsoft Excel allows a local attacker to disclose sensitive memory contents when a victim opens a specially crafted workbook. The flaw affects a broad swath of Microsoft Office product lines - from Excel 2016 through Office LTSC 2024 and their Mac counterparts - as confirmed by CPE enumeration. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates exploitation as none and technical impact as partial, placing this in the moderate real-world priority tier despite the C:H CVSS rating.
Out-of-bounds read in Microsoft Excel's file parsing engine exposes sensitive memory contents when a victim opens a specially crafted workbook, affecting Excel 2016 through Office LTSC 2024 and Office Online Server across both Windows and macOS platforms. The CVSS vector (AV:L/UI:R/C:H/I:N/A:N) confirms impact is limited to confidentiality loss - no code execution results - and requires local user interaction to trigger. No public exploit has been identified and CISA has not listed this in KEV; with an EPSS of 0.46% and SSVC exploitation status of none, this is appropriate for standard patch cycle prioritization rather than emergency response.
Out-of-bounds read in Microsoft Excel and related Office products exposes adjacent process memory to local information disclosure when a user opens a specially crafted spreadsheet file. The flaw spans a broad set of Microsoft Office versions across Windows and macOS - including Excel 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office Online Server - with vendor-released patches now available for all affected builds. No active exploitation has been confirmed by CISA KEV, and EPSS places exploitation probability at 0.35% (27th percentile), consistent with SSVC's assessment of no current exploitation and non-automatable delivery.
Untrusted pointer dereference in Microsoft Excel exposes sensitive in-process memory to a local attacker across virtually the entire Office product family - Excel 2016 through Office LTSC 2024 on Windows and macOS, plus Office Online Server. An attacker must deliver a crafted spreadsheet and induce the victim to open it; successful exploitation yields high confidentiality impact with no integrity or availability effect. No public exploit code or active exploitation has been identified; EPSS at 0.46% (37th percentile) and SSVC exploitation status of 'none' are consistent with low real-world risk at this time.
Out-of-bounds read in Microsoft Excel's spreadsheet parser (CWE-125) exposes affected systems to both local information disclosure and application crash when a victim opens a specially crafted file, spanning Excel 2016 through Office LTSC 2024 and Office 365 for Mac. The CVSS vector (AV:L/UI:R/A:H) reveals that while the CVE description emphasizes information disclosure, the primary real-world impact is application availability - the invalid memory read can crash Excel (A:H), with incidental memory content leakage (C:L) as a secondary effect. No public exploit code has been identified at time of analysis and CISA SSVC assigns exploitation status of none, consistent with a low EPSS score of 0.31% at the 23rd percentile.
Heap-based buffer overflow in Microsoft Office Excel triggers a local information disclosure when a target user opens a maliciously crafted document. Affecting Excel 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS, the vulnerability yields only limited confidentiality impact (C:L) with no integrity or availability consequence, placing it in the Low severity tier at CVSS 3.3. No public exploit code exists and no active exploitation has been confirmed - CISA's SSVC framework rates exploitation as none, automatable as no, and technical impact as partial, consistent with the low EPSS probability of 0.27% (19th percentile).
Out-of-bounds read in Microsoft Excel exposes limited memory contents to a local attacker when a user opens a specially crafted workbook. Affected product lines span Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and multiple Mac variants. With a CVSS score of 3.3 (Low), no public exploit identified at time of analysis, and no CISA KEV listing, this is a low-urgency information disclosure issue - though a notable conflict exists between the description's claim of network-based disclosure and the CVSS AV:L (local) vector that warrants verification against the vendor advisory.
Information disclosure in Microsoft Office Excel and related products results from an out-of-bounds read vulnerability that requires local access and user interaction to exploit. An attacker can leverage this flaw to read sensitive data from memory on an affected system. No patch is currently available for this vulnerability affecting Office Long Term Servicing Channel, 365 Apps, and Office Online Server.
Information disclosure in Microsoft Excel allows local attackers with user interaction to read sensitive data through improper input validation in Office 365 Apps and Long Term Servicing Channel. An attacker must socially engineer a user into opening a specially crafted file to trigger the vulnerability. No patch is currently available for this medium-severity issue.
Local code execution in Microsoft Excel via an out-of-bounds read allows an unauthenticated attacker to run arbitrary code when a user opens a specially crafted file, affecting Microsoft 365 Apps, Excel 2016, Office 2019, and Office LTSC 2021/2024 (including macOS). Exploitation requires user interaction and executes code in the context of the opening user without privilege escalation. No public exploit or active exploitation has been identified, and the EPSS score is low at 0.52% (43rd percentile), making this a moderate-priority vulnerability rather than an emergency.
Use-after-free in Microsoft Excel lets an attacker execute arbitrary code in the context of the user who opens a specially crafted Excel workbook. Affected builds include Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021 (Windows and macOS), and Office LTSC 2024 across x86 and x64; the CVSS vector shows PR:N (no authentication needed) but UI:R (the victim must open the malicious file, typically delivered as an email attachment, download, or shared file), so there is no remotely reachable service to attack. No public exploit code is identified and the issue is not in CISA KEV at time of analysis, while the EPSS score of 0.61% (48th percentile) indicates low predicted exploitation activity; because the code executes in the opening user's process and privilege context, the impact ceiling is that user's rights rather than SYSTEM.
Local code execution in Microsoft Excel is possible through an untrusted pointer dereference when a user opens a specially crafted workbook. Affected products include Microsoft 365 Apps, Excel 2016, Office 2019, and Office LTSC 2021/2024 on Windows and macOS. No public exploit code or active exploitation has been identified; EPSS is 0.52% (43rd percentile), and exploitation requires user interaction (opening the file).
Local code execution in Microsoft Excel allows an attacker to execute arbitrary code by convincing a user to open a maliciously crafted workbook. Affected versions include Microsoft Excel 2016, Office 2019, Microsoft 365 Apps for Enterprise, Office LTSC 2021 (including macOS), Office LTSC 2024, and potentially Office Online Server. The vulnerability has a CVSS score of 7.8 (High) but requires user interaction (UI:R) and local access (AV:L); EPSS is low (0.52%, 43rd percentile) and no public exploit or active exploitation has been identified at time of analysis.
Untrusted pointer dereference in Microsoft Excel (CWE-822) lets an attacker execute arbitrary code in the context of any user who opens a crafted spreadsheet, affecting Excel 2016, Office 2019, Office LTSC 2021 (Windows and macOS), Office LTSC 2024 and Microsoft 365 Apps for Enterprise (CVSS 7.8, AV:L/PR:N/UI:R/S:U, high confidentiality, integrity and availability impact). The flaw requires no privileges and no non-default configuration, but it is gated by social engineering - the victim must open the file - and Protected View, Mark-of-the-Web warnings and Office file/extension block policies can interrupt the chain, with code confined to the opening user's context rather than SYSTEM. No public exploit identified at time of analysis, and EPSS is low at 0.56% (45th percentile), so urgency is driven by patch hygiene rather than observed activity.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Use-after-free in Microsoft Excel enables local code execution in the security context of the current user when a victim opens a specially crafted workbook on an affected build of Microsoft 365 Apps, Office 2019, or Office LTSC 2021/2024 (Windows and macOS). Because the flaw is reached through file parsing rather than a network service, delivery depends on social engineering - phishing attachments, shared documents, or downloads - and the assessed vector (AV:L/AC:L/PR:N/UI:R) reflects that the file-open step is the real gate on exploitation. Risk is tempered by the small footprint and low EPSS score (0.42%, 34th percentile), with no CISA KEV listing and no public exploit code identified at time of analysis; this is a moderate-priority, patch-cycle item rather than an emergency, and impact is contained to the user's own privileges since scope is unchanged.
A type-confusion memory-corruption flaw in Microsoft Excel lets an attacker execute arbitrary code at the privilege level of the logged-on user when a victim opens or previews a specially crafted workbook. No credentials or prior foothold are required (PR:N per the assessed vector), but the attack is local file-delivery and user-interaction gated (UI:R) - the victim must open or preview the malicious spreadsheet, which is the primary limiting factor; Protected View and File Block policies further reduce realistic exploitation. There is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS is low (0.53%, 44th percentile), making this a genuine but second-tier patching priority relative to internet-facing, no-interaction issues.
Type confusion in Microsoft Excel enables local code execution when a user opens a specially crafted workbook. The issue affects Microsoft 365 Apps, Excel 2016, Office 2019, and Office LTSC 2021/2024, with Office LTSC 2021 also listed for macOS; exploitation depends on user interaction and runs at the invoking user's privilege level, so untrusted spreadsheets delivered by phishing or file sharing are the main vector. EPSS is 0.53% (44th percentile), no public exploit identified at time of analysis, and the supplied intelligence does not indicate confirmed active exploitation.
Use-after-free memory corruption in Microsoft Excel allows code execution in the context of the user who opens a specially crafted workbook. Affected configurations are default installations of Microsoft 365 Apps, Excel 2016, Office 2019, and Office LTSC 2021/2024, including the macOS LTSC 2021 builds; the attacker needs no credentials on the target, but must convince a user to open or preview a malicious file (CVSS 7.8, AV:L/PR:N/UI:R). No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.38% (30th percentile), making this a patch-priority item rather than an emergency, per the vendor advisory at msrc.microsoft.com.
Use-after-free in Microsoft Excel enables an attacker to execute code at the privilege level of a user who opens a crafted workbook. Affected builds include Microsoft 365 Apps, Excel 2016, Office 2019, and Office LTSC 2021/2024; exploitation requires user interaction and no privileges but is local to the opened document. No public exploit identified at time of analysis and no CISA KEV entry is present in the supplied data, while EPSS is 0.38% (30th percentile), making targeted file-based delivery the realistic path rather than broad opportunistic exploitation.
Code execution in Microsoft Excel 2016, Office 2019, Office LTSC 2021/2024, and Microsoft 365 Apps arises from a use-after-free condition (CWE-416) triggered when a user opens a crafted workbook. The CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): the attacker cannot reach Excel over the network and must rely on social engineering, but successful exploitation runs code with the victim user's privileges and can compromise confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, EPSS is low at 0.38% (30th percentile), and the local vector plus required user interaction make this a genuine but not emergency-tier priority.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). An attacker with local access can trigger the vulnerability through user interaction (opening a malicious file) to execute arbitrary code with the privileges of the Excel process, potentially achieving full system compromise. No KEV status, active exploitation data, or public POC availability was confirmed in the provided dataset, but the high CVSS score and local attack vector indicate this requires prompt patching.
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Release of invalid pointer or reference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Command Injection vulnerability could allow attackers to inject arbitrary commands into system command execution.
Microsoft Excel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Microsoft Excel Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
Microsoft Excel Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Microsoft Excel Denial of Service Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 17.6% and no vendor patch available.
Microsoft Word Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Microsoft Word Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Microsoft Word Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Microsoft Office Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
Microsoft Office Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
Microsoft Office Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. [CVSS 7.8 HIGH]
Information disclosure in Microsoft Excel allows unauthenticated remote attackers to read sensitive memory contents by enticing a user to open a specially crafted Excel document. The flaw affects multiple Microsoft Office products, including Office LTSC 2024, Office LTSC 2021, Office Online Server, and Microsoft 365 Apps, and requires user interaction (opening or previewing the file) for exploitation. No public exploit code has been identified, and CISA SSVC rates exploitation as none; the risk is considered a moderate-priority information-disclosure issue.
Out-of-bounds read in Microsoft Excel allows an unauthenticated remote attacker to disclose confidential process memory, but only when a targeted user opens a maliciously crafted Excel file. No public exploit or active exploitation has been identified (CISA SSVC exploitation: none, automatable: no), and the EPSS score was not provided at the time of analysis. The flaw carries a moderate CVSS 6.5 with confidentiality impact only; vendor-released patches are available.
Information disclosure in Microsoft Office Excel allows an unauthenticated attacker to read sensitive system data when a victim opens a crafted spreadsheet. Affected builds include Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, Office for Mac 2021/2024, Office 365 for Mac, and Office Online Server before 16.0.10417.20228. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), exploitation requires user interaction, and no public exploit or active exploitation has been identified at time of analysis; vendor patches are available.
Type confusion (CWE-843) in Microsoft Office Excel enables local information disclosure when a victim opens a specially crafted Excel file. Affected products span Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and multiple Mac Office variants. The vulnerability carries a CVSS 5.5 with High confidentiality impact but no integrity or availability impact; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in Microsoft Office Excel's file parser allows local information disclosure when a victim opens a specially crafted workbook. Affecting Excel 2016 through Microsoft 365 Apps for Enterprise, Office LTSC 2024, Office Online Server, and multiple macOS Office variants, the vulnerability (CWE-125) exposes process memory with high confidentiality impact but no integrity or availability consequences. Microsoft has released patched builds via MSRC; SSVC confirms no active exploitation and non-automatable delivery, placing this squarely within standard monthly patch-cycle priority.
Out-of-bounds read in Microsoft Excel's file parser discloses sensitive memory contents when a victim opens a specially crafted workbook, affecting Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC for Mac 2021/2024, and Office Online Server. The CVSS vector (AV:N/PR:N/UI:R/C:H) indicates unauthenticated network delivery with mandatory user interaction and high confidentiality impact. No public exploit identified at time of analysis; SSVC confirms no known active exploitation and EPSS at 0.64% (46th percentile) reflects below-average exploitation probability, positioning this as a targeted phishing risk rather than an opportunistic threat.
Untrusted pointer dereference (CWE-822) in Microsoft Excel allows a local attacker to disclose sensitive memory contents when a victim opens a specially crafted workbook. The flaw affects a broad swath of Microsoft Office product lines - from Excel 2016 through Office LTSC 2024 and their Mac counterparts - as confirmed by CPE enumeration. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates exploitation as none and technical impact as partial, placing this in the moderate real-world priority tier despite the C:H CVSS rating.
Out-of-bounds read in Microsoft Excel's file parsing engine exposes sensitive memory contents when a victim opens a specially crafted workbook, affecting Excel 2016 through Office LTSC 2024 and Office Online Server across both Windows and macOS platforms. The CVSS vector (AV:L/UI:R/C:H/I:N/A:N) confirms impact is limited to confidentiality loss - no code execution results - and requires local user interaction to trigger. No public exploit has been identified and CISA has not listed this in KEV; with an EPSS of 0.46% and SSVC exploitation status of none, this is appropriate for standard patch cycle prioritization rather than emergency response.
Out-of-bounds read in Microsoft Excel and related Office products exposes adjacent process memory to local information disclosure when a user opens a specially crafted spreadsheet file. The flaw spans a broad set of Microsoft Office versions across Windows and macOS - including Excel 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office Online Server - with vendor-released patches now available for all affected builds. No active exploitation has been confirmed by CISA KEV, and EPSS places exploitation probability at 0.35% (27th percentile), consistent with SSVC's assessment of no current exploitation and non-automatable delivery.
Untrusted pointer dereference in Microsoft Excel exposes sensitive in-process memory to a local attacker across virtually the entire Office product family - Excel 2016 through Office LTSC 2024 on Windows and macOS, plus Office Online Server. An attacker must deliver a crafted spreadsheet and induce the victim to open it; successful exploitation yields high confidentiality impact with no integrity or availability effect. No public exploit code or active exploitation has been identified; EPSS at 0.46% (37th percentile) and SSVC exploitation status of 'none' are consistent with low real-world risk at this time.
Out-of-bounds read in Microsoft Excel's spreadsheet parser (CWE-125) exposes affected systems to both local information disclosure and application crash when a victim opens a specially crafted file, spanning Excel 2016 through Office LTSC 2024 and Office 365 for Mac. The CVSS vector (AV:L/UI:R/A:H) reveals that while the CVE description emphasizes information disclosure, the primary real-world impact is application availability - the invalid memory read can crash Excel (A:H), with incidental memory content leakage (C:L) as a secondary effect. No public exploit code has been identified at time of analysis and CISA SSVC assigns exploitation status of none, consistent with a low EPSS score of 0.31% at the 23rd percentile.
Heap-based buffer overflow in Microsoft Office Excel triggers a local information disclosure when a target user opens a maliciously crafted document. Affecting Excel 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS, the vulnerability yields only limited confidentiality impact (C:L) with no integrity or availability consequence, placing it in the Low severity tier at CVSS 3.3. No public exploit code exists and no active exploitation has been confirmed - CISA's SSVC framework rates exploitation as none, automatable as no, and technical impact as partial, consistent with the low EPSS probability of 0.27% (19th percentile).
Out-of-bounds read in Microsoft Excel exposes limited memory contents to a local attacker when a user opens a specially crafted workbook. Affected product lines span Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and multiple Mac variants. With a CVSS score of 3.3 (Low), no public exploit identified at time of analysis, and no CISA KEV listing, this is a low-urgency information disclosure issue - though a notable conflict exists between the description's claim of network-based disclosure and the CVSS AV:L (local) vector that warrants verification against the vendor advisory.
Information disclosure in Microsoft Office Excel and related products results from an out-of-bounds read vulnerability that requires local access and user interaction to exploit. An attacker can leverage this flaw to read sensitive data from memory on an affected system. No patch is currently available for this vulnerability affecting Office Long Term Servicing Channel, 365 Apps, and Office Online Server.
Information disclosure in Microsoft Excel allows local attackers with user interaction to read sensitive data through improper input validation in Office 365 Apps and Long Term Servicing Channel. An attacker must socially engineer a user into opening a specially crafted file to trigger the vulnerability. No patch is currently available for this medium-severity issue.
Local code execution in Microsoft Excel via an out-of-bounds read allows an unauthenticated attacker to run arbitrary code when a user opens a specially crafted file, affecting Microsoft 365 Apps, Excel 2016, Office 2019, and Office LTSC 2021/2024 (including macOS). Exploitation requires user interaction and executes code in the context of the opening user without privilege escalation. No public exploit or active exploitation has been identified, and the EPSS score is low at 0.52% (43rd percentile), making this a moderate-priority vulnerability rather than an emergency.
Use-after-free in Microsoft Excel lets an attacker execute arbitrary code in the context of the user who opens a specially crafted Excel workbook. Affected builds include Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021 (Windows and macOS), and Office LTSC 2024 across x86 and x64; the CVSS vector shows PR:N (no authentication needed) but UI:R (the victim must open the malicious file, typically delivered as an email attachment, download, or shared file), so there is no remotely reachable service to attack. No public exploit code is identified and the issue is not in CISA KEV at time of analysis, while the EPSS score of 0.61% (48th percentile) indicates low predicted exploitation activity; because the code executes in the opening user's process and privilege context, the impact ceiling is that user's rights rather than SYSTEM.
Local code execution in Microsoft Excel is possible through an untrusted pointer dereference when a user opens a specially crafted workbook. Affected products include Microsoft 365 Apps, Excel 2016, Office 2019, and Office LTSC 2021/2024 on Windows and macOS. No public exploit code or active exploitation has been identified; EPSS is 0.52% (43rd percentile), and exploitation requires user interaction (opening the file).
Local code execution in Microsoft Excel allows an attacker to execute arbitrary code by convincing a user to open a maliciously crafted workbook. Affected versions include Microsoft Excel 2016, Office 2019, Microsoft 365 Apps for Enterprise, Office LTSC 2021 (including macOS), Office LTSC 2024, and potentially Office Online Server. The vulnerability has a CVSS score of 7.8 (High) but requires user interaction (UI:R) and local access (AV:L); EPSS is low (0.52%, 43rd percentile) and no public exploit or active exploitation has been identified at time of analysis.
Untrusted pointer dereference in Microsoft Excel (CWE-822) lets an attacker execute arbitrary code in the context of any user who opens a crafted spreadsheet, affecting Excel 2016, Office 2019, Office LTSC 2021 (Windows and macOS), Office LTSC 2024 and Microsoft 365 Apps for Enterprise (CVSS 7.8, AV:L/PR:N/UI:R/S:U, high confidentiality, integrity and availability impact). The flaw requires no privileges and no non-default configuration, but it is gated by social engineering - the victim must open the file - and Protected View, Mark-of-the-Web warnings and Office file/extension block policies can interrupt the chain, with code confined to the opening user's context rather than SYSTEM. No public exploit identified at time of analysis, and EPSS is low at 0.56% (45th percentile), so urgency is driven by patch hygiene rather than observed activity.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Use-after-free in Microsoft Excel enables local code execution in the security context of the current user when a victim opens a specially crafted workbook on an affected build of Microsoft 365 Apps, Office 2019, or Office LTSC 2021/2024 (Windows and macOS). Because the flaw is reached through file parsing rather than a network service, delivery depends on social engineering - phishing attachments, shared documents, or downloads - and the assessed vector (AV:L/AC:L/PR:N/UI:R) reflects that the file-open step is the real gate on exploitation. Risk is tempered by the small footprint and low EPSS score (0.42%, 34th percentile), with no CISA KEV listing and no public exploit code identified at time of analysis; this is a moderate-priority, patch-cycle item rather than an emergency, and impact is contained to the user's own privileges since scope is unchanged.
A type-confusion memory-corruption flaw in Microsoft Excel lets an attacker execute arbitrary code at the privilege level of the logged-on user when a victim opens or previews a specially crafted workbook. No credentials or prior foothold are required (PR:N per the assessed vector), but the attack is local file-delivery and user-interaction gated (UI:R) - the victim must open or preview the malicious spreadsheet, which is the primary limiting factor; Protected View and File Block policies further reduce realistic exploitation. There is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS is low (0.53%, 44th percentile), making this a genuine but second-tier patching priority relative to internet-facing, no-interaction issues.
Type confusion in Microsoft Excel enables local code execution when a user opens a specially crafted workbook. The issue affects Microsoft 365 Apps, Excel 2016, Office 2019, and Office LTSC 2021/2024, with Office LTSC 2021 also listed for macOS; exploitation depends on user interaction and runs at the invoking user's privilege level, so untrusted spreadsheets delivered by phishing or file sharing are the main vector. EPSS is 0.53% (44th percentile), no public exploit identified at time of analysis, and the supplied intelligence does not indicate confirmed active exploitation.
Use-after-free memory corruption in Microsoft Excel allows code execution in the context of the user who opens a specially crafted workbook. Affected configurations are default installations of Microsoft 365 Apps, Excel 2016, Office 2019, and Office LTSC 2021/2024, including the macOS LTSC 2021 builds; the attacker needs no credentials on the target, but must convince a user to open or preview a malicious file (CVSS 7.8, AV:L/PR:N/UI:R). No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.38% (30th percentile), making this a patch-priority item rather than an emergency, per the vendor advisory at msrc.microsoft.com.
Use-after-free in Microsoft Excel enables an attacker to execute code at the privilege level of a user who opens a crafted workbook. Affected builds include Microsoft 365 Apps, Excel 2016, Office 2019, and Office LTSC 2021/2024; exploitation requires user interaction and no privileges but is local to the opened document. No public exploit identified at time of analysis and no CISA KEV entry is present in the supplied data, while EPSS is 0.38% (30th percentile), making targeted file-based delivery the realistic path rather than broad opportunistic exploitation.
Code execution in Microsoft Excel 2016, Office 2019, Office LTSC 2021/2024, and Microsoft 365 Apps arises from a use-after-free condition (CWE-416) triggered when a user opens a crafted workbook. The CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): the attacker cannot reach Excel over the network and must rely on social engineering, but successful exploitation runs code with the victim user's privileges and can compromise confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, EPSS is low at 0.38% (30th percentile), and the local vector plus required user interaction make this a genuine but not emergency-tier priority.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Use-after-free vulnerability in Microsoft Office Excel that allows local code execution with high severity (CVSS 7.8). An attacker with local access can trigger the vulnerability through user interaction (opening a malicious file) to execute arbitrary code with the privileges of the Excel process, potentially achieving full system compromise. No KEV status, active exploitation data, or public POC availability was confirmed in the provided dataset, but the high CVSS score and local attack vector indicate this requires prompt patching.
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Release of invalid pointer or reference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Command Injection vulnerability could allow attackers to inject arbitrary commands into system command execution.
Microsoft Excel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Microsoft Excel Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
Microsoft Excel Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Microsoft Excel Denial of Service Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 17.6% and no vendor patch available.
Microsoft Word Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Microsoft Word Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Microsoft Word Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Microsoft Office Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
Microsoft Office Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
Microsoft Office Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.