CVE-20XX-?

Microsoft 365 Apps CVEs.

Published CVEs affecting Microsoft 365 Apps, ranked by exploit odds.

668 CVEs · updated 2026-11-06 05:35 UTC

  1. CVE-2026-21509

    Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

    exploited Other Microsoft 365 Apps

    7.8 HIGH 71% exploit odds Fix listed
  2. CVE-2026-40364

    Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

    Memory safety Microsoft 365 Apps

    8.4 HIGH 4% exploit odds Fix listed
  3. CVE-2026-21511

    Deserialization of untrusted data in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

    Code execution Microsoft 365 Apps

    7.5 HIGH 4% exploit odds Fix listed
  4. CVE-2025-47994

    Deserialization of untrusted data in Microsoft Office allows an unauthorized attacker to elevate privileges locally.

    Code execution Microsoft 365 Apps

    7.8 HIGH 3% exploit odds Fix listed
  5. CVE-2025-27751

    Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

    Microsoft 365 Apps

    7.8 HIGH 3% exploit odds Fix listed
  6. CVE-2025-47175

    Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

    Microsoft 365 Apps

    7.8 HIGH 2% exploit odds No fix listed
  7. CVE-2025-47165

    Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

    Microsoft 365 Apps

    7.8 HIGH 2% exploit odds Fix listed
  8. CVE-2025-47171

    Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally.

    Microsoft 365 Apps

    6.7 MEDIUM 2% exploit odds Fix listed
  9. CVE-2025-21364

    Microsoft Excel Security Feature Bypass Vulnerability

    Microsoft 365 Apps

    7.8 HIGH 2% exploit odds Fix listed
  10. CVE-2026-21514

    Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.

    exploited Other Microsoft 365 Apps

    7.8 HIGH 2% exploit odds Fix listed
  11. CVE-2026-70242

    Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

    Memory safety Microsoft 365 Apps

    9.8 CRITICAL 2% exploit odds Fix listed
  12. CVE-2026-21260

    Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

    Disclosure Microsoft 365 Apps

    7.5 HIGH 2% exploit odds Fix listed
  13. CVE-2026-26144

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

    XSS Microsoft 365 Apps

    7.5 HIGH 1% exploit odds Fix listed
  14. CVE-2026-70291

    Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

    Memory safety Microsoft 365 Apps

    9.8 CRITICAL 1% exploit odds Fix listed
  15. CVE-2025-47957

    Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

    Microsoft 365 Apps

    8.4 HIGH 1% exploit odds Fix listed
  16. CVE-2026-81385

    Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network.

    Code execution Microsoft 365 Apps

    8.8 HIGH 1% exploit odds Fix listed
  17. CVE-2026-97749

    Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

    Memory safety Browser & mail Microsoft 365 Apps

    9.8 CRITICAL 1% exploit odds Fix listed
  18. CVE-2025-21186

    Microsoft Access Remote Code Execution Vulnerability

    Microsoft 365 Apps

    7.8 HIGH 1% exploit odds Fix listed
  19. CVE-2026-88156

    Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

    Memory safety Browser & mail Microsoft 365 Apps

    9.8 CRITICAL 1% exploit odds Fix listed
  20. CVE-2026-97016

    Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

    Memory safety Browser & mail Microsoft 365 Apps

    9.8 CRITICAL 1% exploit odds Fix listed
  21. CVE-2025-29792

    Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.

    Microsoft 365 Apps

    7.3 HIGH 1% exploit odds Fix listed
  22. CVE-2025-21366

    Microsoft Access Remote Code Execution Vulnerability

    Microsoft 365 Apps

    7.8 HIGH 1% exploit odds Fix listed
  23. CVE-2025-21381

    Microsoft Excel Remote Code Execution Vulnerability

    Microsoft 365 Apps

    7.8 HIGH 1% exploit odds Fix listed
  24. CVE-2026-70300

    Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

    Other Microsoft 365 Apps

    9.8 CRITICAL 1% exploit odds Fix listed
  25. CVE-2026-70281

    Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.

    Memory safety Microsoft 365 Apps

    7.5 HIGH 1% exploit odds Fix listed
  26. CVE-2025-27745

    Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

    Microsoft 365 Apps

    7.8 HIGH 1% exploit odds Fix listed
  27. CVE-2025-27748

    Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

    Microsoft 365 Apps

    7.8 HIGH 1% exploit odds Fix listed
  28. CVE-2025-27749

    Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

    Microsoft 365 Apps

    7.8 HIGH 1% exploit odds Fix listed
  29. CVE-2025-27752

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

    Microsoft 365 Apps

    7.8 HIGH 1% exploit odds Fix listed
  30. CVE-2025-29791

    Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

    Microsoft 365 Apps

    7.8 HIGH 1% exploit odds Fix listed
  31. CVE-2025-21395

    Microsoft Access Remote Code Execution Vulnerability

    Microsoft 365 Apps

    7.8 HIGH 1% exploit odds Fix listed
  32. CVE-2025-21383

    Microsoft Excel Information Disclosure Vulnerability

    Microsoft 365 Apps

    7.8 HIGH 1% exploit odds Fix listed
  33. CVE-2026-70263

    Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

    Memory safety Microsoft 365 Apps

    6.5 MEDIUM 1% exploit odds Fix listed
  34. CVE-2026-102867

    Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

    Memory safety Microsoft 365 Apps

    6.5 MEDIUM 1.0% exploit odds Fix listed
  35. CVE-2025-21365

    Microsoft Office Remote Code Execution Vulnerability

    Microsoft 365 Apps

    7.8 HIGH 1.0% exploit odds Fix listed
  36. CVE-2026-78509

    Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

    Memory safety Microsoft 365 Apps

    9.8 CRITICAL 1.0% exploit odds Fix listed
  37. CVE-2026-70206

    Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

    Memory safety Microsoft 365 Apps

    6.5 MEDIUM 1.0% exploit odds Fix listed
  38. CVE-2026-88178

    Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.

    Memory safety Microsoft 365 Apps

    9.8 CRITICAL 1.0% exploit odds Fix listed
  39. CVE-2026-97743

    Use after free in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

    Memory safety Microsoft 365 Apps

    6.5 MEDIUM 1.0% exploit odds Fix listed
  40. CVE-2026-97760

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

    Memory safety Microsoft 365 Apps

    6.5 MEDIUM 1.0% exploit odds Fix listed
  41. CVE-2026-97779

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

    Memory safety Microsoft 365 Apps

    6.5 MEDIUM 1.0% exploit odds Fix listed
  42. CVE-2025-24057

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

    Microsoft 365 Apps

    7.8 HIGH 1.0% exploit odds Fix listed
  43. CVE-2025-26630

    Use after free in Microsoft Office Access allows an unauthorized attacker to execute code locally.

    Microsoft 365 Apps

    7.8 HIGH 1.0% exploit odds Fix listed
  44. CVE-2026-72977

    Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

    Memory safety Microsoft 365 Apps

    6.5 MEDIUM 1.0% exploit odds Fix listed
  45. CVE-2026-105718

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

    Memory safety Microsoft 365 Apps

    8.8 HIGH 1.0% exploit odds Fix listed
  46. CVE-2026-100209

    Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

    Memory safety Microsoft 365 Apps

    8.8 HIGH 0.9% exploit odds Fix listed
  47. CVE-2025-21354

    Microsoft Excel Remote Code Execution Vulnerability

    Microsoft 365 Apps

    8.4 HIGH 0.9% exploit odds Fix listed
  48. CVE-2026-88183

    Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

    Memory safety Microsoft 365 Apps

    6.5 MEDIUM 0.9% exploit odds Fix listed
  49. CVE-2026-88192

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

    Memory safety Microsoft 365 Apps

    6.5 MEDIUM 0.9% exploit odds Fix listed
  50. CVE-2026-88203

    Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

    Disclosure Microsoft 365 Apps

    6.5 MEDIUM 0.9% exploit odds Fix listed

All CVEs affecting Microsoft 365 Apps that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.