OF
Productivity
Office
On CISA KEVExploited in the wildRansomware-linked
1,557
CVEs
43
On KEV
9.8
Max CVSS
163
New 30D
Severity mix
Critical 21High 478Medium 1Low 0
Watch
Add Office to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-0806 | 8.8 | Jan 10 | Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution… Affected: 2007; 2010; 2013; 2016; 2016 |
| CVE-2018-0805 | 8.8 | Jan 10 | Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution… Affected: 2007; 2010; 2013; 2016; 2016 |
| CVE-2018-0804 | 8.8 | Jan 10 | Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution… Affected: 2007; 2010; 2013; 2016; 2016 |
| CVE-2018-0801 | 8.8 | Jan 10 | Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way… Affected: 2007; 2010; 2013; 2016; 2016 |
| CVE-2018-0796 | 8.8 | Jan 10 | Microsoft Excel in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way… Affected: 2016 |
| CVE-2018-0795 | 8.8 | Jan 10 | Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft… Affected: 2010; 2016; 2016 |
| CVE-2018-0794 | 8.8 | Jan 10 | Microsoft Word in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way… Affected: 2010; 2016; 2016 |
| CVE-2018-0792 | 8.8 | Jan 10 | Microsoft Word 2016 in Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Word Remote Code Execution… Affected: 2016; 2016 |
| CVE-2017-11854 | 8.8 | Nov 15 | Microsoft Word 2007 Service Pack 3, Microsoft Word 2010 Service Pack 2, Microsoft Office 2010 Service Pack 2, and Microsoft Office Compatibility Pack Service Pack 3 allow an… Affected: 2010 |
| CVE-2017-8528 | 8.8 | Jun 15 | Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, Windows Server 2016,… Affected: 2007; 2010 |
| CVE-2017-8527 | 8.8 | Jun 15 | Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server… Affected: 2007; 2010 |
| CVE-2017-8510 | 8.8 | Jun 15 | A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability" Affected: 2007; 2010; 2013; 2016 |
| CVE-2017-0283 | 8.8 | Jun 15 | Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, Windows Server 2016,… Affected: 2007; 2010 |
| CVE-2017-8512 | 8.8 | Jun 15 | A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability" Affected: Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 RT Service Pack 1, Microsoft Office 2013 Service Pack 1, Microsoft Office 2016, Microsoft Office Online Server 2016, Microsoft Office Web Apps 2010 Service Pack 2, Microsoft Office Web Apps Server 2013 Service Pack 1, Microsoft SharePoint Enterprise Server 2013 Service Pack 1, Microsoft SharePoint Enterprise Server 2016, and Word Automation Services. |
| CVE-2017-8509 | 8.8 | Jun 15 | A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability" Affected: Microsoft Office 2007 Service Pack 3, Microsoft Office Compatibility Pack Service Pack 3, Microsoft Word 2007, Microsoft Office 2010 Service Pack 2, Microsoft Word 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, Microsoft Office 2016, Microsoft Office Web Apps 2010 Service Pack 2, Microsoft Office Web Apps Server 2013 Service Pack 1, Microsoft Word 2013 RT Service Pack 1, Microsoft OneNote 2010 Service Pack 2, Microsoft SharePoint Enterprise Server 2013 Service Pack 1, Microsoft SharePoint Enterprise Server 2016, and Microsoft Word 2016 |
| CVE-2016-0183 | 8.8 | May 11 | The Windows font library in Microsoft Office 2010 SP2, Word 2010 SP2, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allows remote attackers… Affected: 2010 |
| CVE-2016-0145 | 8.8 | Apr 12 | The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold… Affected: 2007; 2010 |
| CVE-2013-0006 | 8.8 | Jan 9 | Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka… Affected: 2003; 2007; 2007 |
| CVE-2025-47994 | 8.6 | Jul 8 | Deserialization of untrusted data in Microsoft Office allows an unauthorized attacker to elevate privileges locally Affected: 2016; 2016; 2019; 2019 |
| CVE-2026-78510 | 8.4 | Sep 8 | Microsoft Outlook and Word Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2026-55045 | 8.4 | Jul 14 | Microsoft Office Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2026-45463 | 8.4 | Jun 9 | Microsoft Office Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2026-45461 | 8.4 | Jun 9 | Microsoft Office Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2026-45458 | 8.4 | Jun 9 | Microsoft Outlook and Word Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2026-45456 | 8.4 | Jun 9 | Microsoft Outlook and Word Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2026-45474 | 8.4 | Jun 9 | Microsoft Office Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2026-45472 | 8.4 | Jun 9 | Microsoft Office Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2026-40367 | 8.4 | May 12 | Microsoft Word Remote Code Execution Vulnerability Affected: 2019; 2019 |
| CVE-2026-40361 | 8.4 | May 12 | Microsoft Outlook and Word Remote Code Execution Vulnerability Affected: 2019; 2019 |
| CVE-2026-40358 | 8.4 | May 12 | Microsoft Office Remote Code Execution Vulnerability Affected: 2016; 2016; 2019; 2019 |
| CVE-2026-40366 | 8.4 | May 12 | Microsoft Word Remote Code Execution Vulnerability Affected: 2019; 2019 |
| CVE-2026-40364 | 8.4 | May 12 | Microsoft Word Remote Code Execution Vulnerability Affected: 2019; 2019 |
| CVE-2026-40363 | 8.4 | May 12 | Microsoft Office Remote Code Execution Vulnerability Affected: 2016; 2016; 2019; 2019 |
| CVE-2026-33115 | 8.4 | Apr 14 | Microsoft Word Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2026-33114 | 8.4 | Apr 14 | Microsoft Word Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2026-32190 | 8.4 | Apr 14 | Microsoft Office Remote Code Execution Vulnerability Affected: 2016; 2016; 2019; 2019 |
| CVE-2026-20952 | 8.4 | Jan 13 | Microsoft Office Remote Code Execution Vulnerability Affected: 2016; 2016; 2019; 2019 |
| CVE-2026-20953 | 8.4 | Jan 13 | Microsoft Office Remote Code Execution Vulnerability Affected: 2016; 2016; 2019; 2019 |
| CVE-2026-20944 | 8.4 | Jan 13 | Microsoft Word Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2025-54910 | 8.4 | Sep 9 | Microsoft Office Remote Code Execution Vulnerability Affected: 2016; 2016; 2019; 2019 |
| CVE-2025-53784 | 8.4 | Aug 12 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally Affected: All versions, or not specified |
| CVE-2025-53740 | 8.4 | Aug 12 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally Affected: 2016; 2016; 2019; 2019 |
| CVE-2025-53733 | 8.4 | Aug 12 | Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally Affected: 2019; 2019 |
| CVE-2025-53731 | 8.4 | Aug 12 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally Affected: 2016; 2016; 2019; 2019 |
| CVE-2025-49697 | 8.4 | Jul 8 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally Affected: 2016; 2016; 2019; 2019 |
| CVE-2025-49696 | 8.4 | Jul 8 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally Affected: 2016; 2016; 2019; 2019 |
| CVE-2025-49695 | 8.4 | Jul 8 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally Affected: 2016; 2016; 2019; 2019 |
| CVE-2025-32717 | 8.4 | Jun 11 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally Affected: All versions, or not specified |
| CVE-2025-47957 | 8.4 | Jun 10 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally Affected: All versions, or not specified |
| CVE-2025-47953 | 8.4 | Jun 10 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally Affected: 2016; 2019 |
The 500 most important CVEs for this product (exploited first, then by severity)
