CVE-2026-55134

Microsoft Word Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 10 more

CVE-2026-55038

Microsoft Word Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 10 more

CVE-2026-55032

Microsoft Word Remote Code Execution Vulnerability

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 10 more

CVE-2026-55033

Microsoft Word Remote Code Execution Vulnerability

Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 10 more

CVE-2026-45458

Microsoft Outlook and Word Remote Code Execution Vulnerability

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 10 more

CVE-2026-45471

Microsoft Word Remote Code Execution Vulnerability

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Microsoft 365 Apps For Enterprise and 13 more

CVE-2026-45456

Microsoft Outlook and Word Remote Code Execution Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2016 and 10 more

CVE-2026-44803

Windows Graphics Component Remote Code Execution Vulnerability

Integer overflow or wraparound in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Excel Powerpoint Windows 10 1607 and 26 more

CVE-2026-44812

Windows Graphics Component Remote Code Execution Vulnerability

Integer overflow or wraparound in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Excel Powerpoint Windows 10 1607 and 26 more

CVE-2026-45649

Office for Android Spoofing Vulnerability

Improper access control in Office for Android allows an unauthorized attacker to perform spoofing locally.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Excel Excel For Android Powerpoint and 3 more

CVE-2026-41100

Microsoft 365 Copilot for Android Spoofing Vulnerability

Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Copilot 365 Copilot Android 365 Copilot Android and 5 more

CVE-2026-40361

Microsoft Outlook and Word Remote Code Execution Vulnerability

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office 2019 and 7 more

CVE-2026-40367

Microsoft Word Remote Code Execution Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office 2019 and 10 more

CVE-2026-40421

Microsoft Word Information Disclosure Vulnerability

Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office 2019 and 5 more

CVE-2026-40366

Microsoft Word Remote Code Execution Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office 2019 and 7 more

CVE-2022-24511

Microsoft Office Word Tampering Vulnerability

Microsoft Office Word Tampering Vulnerability

CVSS 3.1 · 5.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office Long Term Servicing Channel and 1 more

CVE-2022-29107

Microsoft Office Security Feature Bypass Vulnerability

Microsoft Office Security Feature Bypass Vulnerability

CVSS 3.1 · 5.5 Medium EPSS 3.1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office Long Term Servicing Channel and 2 more

CVE-2022-41060

Microsoft Word Information Disclosure Vulnerability

Microsoft Word Information Disclosure Vulnerability

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office Long Term Servicing Channel and 5 more

CVE-2023-33150

Microsoft Office Security Feature Bypass Vulnerability

Microsoft Office Security Feature Bypass Vulnerability

CVSS 3.1 · 9.6 Critical EPSS 2.1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office Long Term Servicing Channel and 1 more

CVE-2023-29335

Microsoft Word Security Feature Bypass Vulnerability

Microsoft Word Security Feature Bypass Vulnerability

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office Long Term Servicing Channel and 13 more