CVE-2026-21509

Microsoft Office Security Feature Bypass Vulnerability

Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

CVSS 3.1 · 7.8 High EPSS 70.8% KEV · Listed

Vendors

Microsoft

Products

365 Apps Office Office 2016 and 4 more

CVE-2026-20943

Microsoft Office Click-To-Run Remote Code Execution Vulnerability

Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Office Office 2016 Office Deployment Tool and 3 more

CVE-2026-20953

Microsoft Office Remote Code Execution Vulnerability

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office 2016 and 6 more

CVE-2026-20952

Microsoft Office Remote Code Execution Vulnerability

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office 2016 and 6 more

CVE-2026-26113

Microsoft Office Remote Code Execution Vulnerability

Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Apps For Enterprise Office and 11 more

CVE-2025-21392

Microsoft Office Remote Code Execution Vulnerability

Microsoft Office Remote Code Execution Vulnerability

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office 2016 and 6 more

CVE-2025-47173

Microsoft Office Remote Code Execution Vulnerability

Improper input validation in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office 2016 and 6 more

CVE-2025-47175

Microsoft PowerPoint Remote Code Execution Vulnerability

Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS 2.5% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office 2016 and 8 more

CVE-2025-53741

Microsoft Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 365 Apps Excel and 13 more

CVE-2025-53731

Microsoft Office Remote Code Execution Vulnerability

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 365 Apps Office and 9 more

CVE-2025-53735

Microsoft Excel Remote Code Execution Vulnerability

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 365 Apps Excel and 12 more

CVE-2025-53739

Microsoft Excel Remote Code Execution Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 365 Apps Excel and 12 more

CVE-2025-54896

Microsoft Excel Remote Code Execution Vulnerability

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 365 Apps Excel and 12 more

CVE-2025-54898

Microsoft Excel Remote Code Execution Vulnerability

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 365 Apps Excel and 12 more

CVE-2025-54899

Microsoft Excel Remote Code Execution Vulnerability

Free of memory not on the heap in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 365 Apps Excel and 12 more

CVE-2025-54902

Microsoft Excel Remote Code Execution Vulnerability

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 365 Apps Excel and 12 more

CVE-2025-54904

Microsoft Excel Remote Code Execution Vulnerability

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 365 Apps Excel and 12 more

CVE-2025-54906

Microsoft Office Remote Code Execution Vulnerability

Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office 2016 and 9 more

CVE-2025-54910

Microsoft Office Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office 2016 and 6 more

CVE-2025-59221

Microsoft Word Remote Code Execution Vulnerability

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 365 Apps Office and 12 more