Word vulnerabilities | LiveThreat CVE Feed

Product

Word

by Microsoft · last CVE Sep 8, 2026

On CISA KEVExploited in the wildRansomware-linked

321

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities321 In the news0 Timeline

Severity mix

Critical 4High 158Medium 52Low 2

Severity

All severities321 Critical4 High158 Medium52 Low2

Exploitation

On CISA KEV11 Exploited in the wild11

Watch

Add Word to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2021-31178	5.5	16%	May 11	Microsoft Office Information Disclosure Vulnerability Affected: 2013; 2013; 2016
CVE-2020-1503	5.5	5%	Aug 17	An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory Affected: 2010; 2013; 2013; 2016
CVE-2020-1445	5.5	6%	Jul 14	An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka 'Microsoft Office Information Disclosure Vulnerability' Affected: 2010; 2013; 2013; 2016
CVE-2020-1342	5.5	6%	Jul 14	An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose the contents of… Affected: 2010; 2013; 2013; 2016
CVE-2019-0561	5.5	8%	Jan 8	An information disclosure vulnerability exists when Microsoft Word macro buttons are used improperly, aka "Microsoft Word Information Disclosure Vulnerability." This affects… Affected: 2010; 2013; 2013; 2016
CVE-2018-8378	5.5	7%	Aug 15	An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose the contents of… Affected: Automation Services on Microsoft SharePoint Server 2010 Service Pack 2
CVE-2017-0105	5.5	30%	Mar 17	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, and Office Web… Affected: 2007
CVE-2017-0029	5.5	16%	Mar 17	Microsoft Office 2010 SP2, Word 2010 SP2, Word 2013 RT SP1, and Word 2016 allow remote attackers to cause a denial of service (application hang) via a crafted Office document, aka… Affected: 2010; 2013; 2016
CVE-2016-3279	5.5	16%	Jul 13	Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Excel 2013 SP1, PowerPoint 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Word… Affected: 2010; 2013; 2016
CVE-2016-3234	5.5	26%	Jun 16	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation… Affected: 2007; 2010
CVE-2026-72976	5.0	1%	Sep 8	Microsoft Office Word Information Disclosure Vulnerability Affected: 2016; 2016
CVE-2026-40421	4.3	1%	May 12	Microsoft Word Information Disclosure Vulnerability Affected: 2016; 2016
CVE-2020-1229	4.3	4%	Jun 9	A security feature bypass vulnerability exists in Microsoft Outlook when Office fails to enforce security settings configured on a system, aka 'Microsoft Outlook Security Feature… Affected: 2010; 2013; 2013; 2016
CVE-2016-0012	4.3	11%	Jan 13	Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Visio 2010 SP2, Word 2010 SP2,… Affected: 2007; 2010; 2013; 2013; 2016
CVE-2020-17020	3.3	1%	Nov 11	Microsoft Word Security Feature Bypass Vulnerability Affected: 2010; 2013; 2013; 2016
CVE-2018-0919	3.3	12%	Mar 14	Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps 2013… Affected: 2010; 2013; 2013; 2016
CVE-2015-6172	–	54%	Dec 9	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2016, Word 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary… Affected: 2007; 2010; 2013; 2013
CVE-2015-6124	–	14%	Dec 9	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a… Affected: 2007
CVE-2015-6092	–	15%	Nov 11	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to… Affected: 2007; 2010; 2013; 2013; 2016
CVE-2015-6091	–	15%	Nov 11	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, and Word Viewer allow remote attackers to execute arbitrary code via a crafted… Affected: 2007; 2010; 2013; 2013; 2016
CVE-2015-2503	–	17%	Nov 11	Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office… Affected: 2007; 2010; 2013; 2013; 2016
CVE-2015-2470	–	27%	Aug 15	Integer underflow in Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office for Mac 2011, and Word Viewer allows remote attackers to execute… Affected: 2007
CVE-2015-2423	–	20%	Aug 15	Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Excel… Affected: 2007; 2010; 2013; 2013; 2016
CVE-2015-2468	–	43%	Aug 15	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibility Pack SP3, Word Viewer,… Affected: 2007; 2010; 2013; 2013
CVE-2015-2469	–	27%	Aug 15	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, and Office for Mac 2011 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office… Affected: 2007; 2010
CVE-2015-2380	–	14%	Jul 14	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, and Word 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory… Affected: 2007; 2010; 2010; 2013; 2013
CVE-2015-2379	–	14%	Jul 14	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, and Word Viewer allow remote attackers to execute arbitrary code or… Affected: 2007; 2013; 2013
CVE-2015-1682	–	20%	May 13	Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 SP1, Excel 2013 SP1, PowerPoint 2013 SP1, Word 2013 SP1, Office 2013 RT SP1, Excel 2013… Affected: 2010; 2011; 2013; 2013
CVE-2015-1651	–	16%	Apr 14	Use-after-free vulnerability in Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allows remote attackers to execute arbitrary code via a crafted Office… Affected: 2007
CVE-2015-1650	–	29%	Apr 14	Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word Viewer, Office Compatibility Pack SP3, Word… Affected: 2007; 2010; 2013
CVE-2015-1649	–	26%	Apr 14	Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server… Affected: 2007; 2010; 2013
CVE-2015-0097	–	41%	Mar 11	Microsoft Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Excel 2010 SP2, PowerPoint 2010 SP2, and Word 2010 SP2 allow remote attackers to execute arbitrary code via a crafted… Affected: 2007; 2010
CVE-2015-0086	–	15%	Mar 11	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 Gold and SP1, Word 2013 RT Gold and SP1, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on… Affected: 2007; 2010; 2013; 2013
CVE-2015-0085	–	19%	Mar 11	Use-after-free vulnerability in Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2,… Affected: 2007; 2010; 2013; 2013; 2013
CVE-2015-0065	–	30%	Feb 11	Microsoft Word 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka… Affected: 2007
CVE-2015-0064	–	30%	Feb 11	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applications 2010 SP2, Word Viewer, and Office Compatibility Pack… Affected: 2007; 2010
CVE-2014-6356	–	12%	Dec 11	Array index error in Microsoft Word 2007 SP3, Word 2010 SP2, and Office Compatibility Pack SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka… Affected: 2007; 2010
CVE-2014-6335	–	16%	Nov 11	Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a… Affected: 2007
CVE-2014-6334	–	17%	Nov 11	Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a… Affected: 2007
CVE-2014-6333	–	18%	Nov 11	Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office… Affected: 2007
CVE-2014-4117	–	17%	Oct 15	Microsoft Office 2007 SP3, Word 2007 SP3, Office 2010 SP1 and SP2, Word 2010 SP1 and SP2, Office for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on… Affected: 2010; 2010
CVE-2014-2778	–	20%	Jun 11	Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted embedded… Affected: 2007
CVE-2014-1758	–	17%	Apr 8	Stack-based buffer overflow in Microsoft Word 2003 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Word Stack Overflow Vulnerability." Affected: 2003
CVE-2014-1757	–	17%	Apr 8	Microsoft Word 2007 SP3 and 2010 SP1 and SP2, and Office Compatibility Pack SP3, allocates memory incorrectly for file conversions from a binary (aka .doc) format to a newer… Affected: 2007; 2010; 2010
CVE-2014-0260	–	18%	Jan 15	Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office Compatibility Pack SP3; Word Viewer; SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps… Affected: 2003; 2007; 2010; 2010; 2013
CVE-2014-0259	–	16%	Jan 15	Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office… Affected: 2007
CVE-2014-0258	–	16%	Jan 15	Microsoft Word 2003 SP3 and 2007 SP3, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory… Affected: 2003; 2007
CVE-2013-6801	–	14%	Nov 18	Microsoft Word 2003 SP2 and SP3 on Windows XP SP3 allows remote attackers to cause a denial of service (CPU consumption) via a malformed .doc file containing an embedded image, as… Affected: 2003; 2003
CVE-2013-3892	–	20%	Oct 9	Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Memory Corruption Vulnerability." Affected: 2007
CVE-2013-3891	–	19%	Oct 9	Microsoft Word 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Memory Corruption Vulnerability." Affected: 2003