OO
Product
Office Online Server
On CISA KEVExploited in the wild
305
CVEs
1
On KEV
9.8
Max CVSS
44
New 30D
Severity mix
Critical 2High 249Medium 52Low 2
Watch
Add Office Online Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-47642 | 7.8 | Jul 14 | Microsoft Excel Remote Code Execution Vulnerability Affected: 16.0.0.0 before 16.0.10417.20175 |
| CVE-2026-58618 | 7.8 | Jul 14 | Microsoft Excel Remote Code Execution Vulnerability Affected: 16.0.0.0 before 16.0.10417.20175 |
| CVE-2026-55948 | 7.8 | Jul 14 | Microsoft Excel Remote Code Execution Vulnerability Affected: 16.0.0.0 before 16.0.10417.20175 |
| CVE-2026-55899 | 7.8 | Jul 14 | Microsoft Excel Remote Code Execution Vulnerability Affected: 16.0.0.0 before 16.0.10417.20175 |
| CVE-2026-50675 | 7.8 | Jul 14 | Microsoft Excel Remote Code Execution Vulnerability Affected: 16.0.0.0 before 16.0.10417.20175 |
| CVE-2026-44823 | 7.8 | Jun 9 | Microsoft Excel Remote Code Execution Vulnerability Affected: 16.0.0.0 before 16.0.10417.20137 |
| CVE-2026-44820 | 7.8 | Jun 9 | Microsoft Excel Remote Code Execution Vulnerability Affected: 16.0.0.0 before 16.0.10417.20137 |
| CVE-2026-44817 | 7.8 | Jun 9 | Microsoft Excel Remote Code Execution Vulnerability Affected: 16.0.0.0 before 16.0.10417.20137 |
| CVE-2026-45469 | 7.8 | Jun 9 | Microsoft Excel Remote Code Execution Vulnerability Affected: 16.0.0.0 before 16.0.10417.20137 |
| CVE-2026-40362 | 7.8 | May 12 | Microsoft Excel Remote Code Execution Vulnerability Affected: 16.0.0.0 before 16.0.10417.20128 |
| CVE-2026-40359 | 7.8 | May 12 | Microsoft Excel Remote Code Execution Vulnerability Affected: 16.0.0.0 before 16.0.10417.20128 |
| CVE-2026-40360 | 7.8 | May 12 | Microsoft Excel Information Disclosure Vulnerability Affected: 16.0.0.0 before 16.0.10417.20128 |
| CVE-2026-32199 | 7.8 | Apr 14 | Microsoft Excel Remote Code Execution Vulnerability Affected: 16.0.0.0 before 16.0.10417.20113 |
| CVE-2026-32198 | 7.8 | Apr 14 | Microsoft Excel Remote Code Execution Vulnerability Affected: 16.0.0.0 before 16.0.10417.20113 |
| CVE-2026-32197 | 7.8 | Apr 14 | Microsoft Excel Remote Code Execution Vulnerability Affected: 16.0.0.0 before 16.0.10417.20113 |
| CVE-2026-32189 | 7.8 | Apr 14 | Microsoft Excel Remote Code Execution Vulnerability Affected: 16.0.0.0 before 16.0.10417.20113 |
| CVE-2026-26112 | 7.8 | Mar 10 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20102 |
| CVE-2026-26109 | 7.8 | Mar 10 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20102 |
| CVE-2026-26108 | 7.8 | Mar 10 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20102 |
| CVE-2026-26107 | 7.8 | Mar 10 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20102 |
| CVE-2026-21259 | 7.8 | Feb 10 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to elevate privileges locally Affected: before 16.0.10417.20097 |
| CVE-2026-20957 | 7.8 | Jan 13 | Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20083 |
| CVE-2026-20955 | 7.8 | Jan 13 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20083 |
| CVE-2026-20950 | 7.8 | Jan 13 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20083 |
| CVE-2025-62564 | 7.8 | Dec 9 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20075 |
| CVE-2025-62563 | 7.8 | Dec 9 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20075 |
| CVE-2025-62561 | 7.8 | Dec 9 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20075 |
| CVE-2025-62560 | 7.8 | Dec 9 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20075 |
| CVE-2025-62556 | 7.8 | Dec 9 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20075 |
| CVE-2025-62203 | 7.8 | Nov 11 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20068 |
| CVE-2025-62201 | 7.8 | Nov 11 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20068 |
| CVE-2025-62200 | 7.8 | Nov 11 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20068 |
| CVE-2025-60727 | 7.8 | Nov 11 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20068 |
| CVE-2025-59236 | 7.8 | Oct 14 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20059 |
| CVE-2025-59233 | 7.8 | Oct 14 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20059 |
| CVE-2025-59231 | 7.8 | Oct 14 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20059 |
| CVE-2025-59225 | 7.8 | Oct 14 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20059 |
| CVE-2025-59224 | 7.8 | Oct 14 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20059 |
| CVE-2025-59223 | 7.8 | Oct 14 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20059 |
| CVE-2025-54904 | 7.8 | Sep 9 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20047 |
| CVE-2025-54903 | 7.8 | Sep 9 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20047 |
| CVE-2025-54902 | 7.8 | Sep 9 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20047 |
| CVE-2025-54900 | 7.8 | Sep 9 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20047 |
| CVE-2025-54898 | 7.8 | Sep 9 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20047 |
| CVE-2025-54896 | 7.8 | Sep 9 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: before 16.0.10417.20047 |
| CVE-2025-53759 | 7.8 | Aug 12 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: All versions, or not specified |
| CVE-2025-53741 | 7.8 | Aug 12 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: All versions, or not specified |
| CVE-2025-53739 | 7.8 | Aug 12 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: All versions, or not specified |
| CVE-2025-53737 | 7.8 | Aug 12 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: All versions, or not specified |
| CVE-2025-53735 | 7.8 | Aug 12 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally Affected: All versions, or not specified |