Product of Microsoft
Office
As of , 29 Microsoft Office vulnerabilities are on CISA's list of exploited vulnerabilities, 3 of them used in ransomware campaigns; 4 were added in 2026. Patch first: CVE-2010-3333.
Patch first
| # | Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|---|
| 1 | CVE-2010-3333Stack-based Buffer Overflow | Microsoft Office | Patch this weekMetasploit module; EPSS 0.89; verified Exploit-DB entry | 0.89 | ||
| 2 | CVE-2016-3235OLE DLL Side Loading | Microsoft Office | Patch this weekMetasploit module; verified Exploit-DB entry | 0.43 | ||
| 3 | CVE-2017-11882Memory Corruption | Microsoft Office | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 4 | CVE-2026-21509Security Feature Bypass | Microsoft Office | Patch this weekEPSS 0.71 | 0.71 | ||
| 5 | CVE-2009-0556PowerPoint Code Injection | Microsoft Office | Patch this weekEPSS 0.67 | 0.67 | ||
| 6 | CVE-2023-23397Outlook Privilege Escalation | Microsoft Office | Patch this weekEPSS 0.97 | 0.97 | ||
| 7 | CVE-2009-0563Buffer Overflow | Microsoft Office | Patch this weekEPSS 0.63 | 0.63 | ||
| 8 | CVE-2013-1331Buffer Overflow | Microsoft Office | Patch this weekEPSS 0.80 | 0.80 | ||
| 9 | CVE-2012-1856MSCOMCTL.OCX Remote Code Execution | Microsoft Office | Patch this weekEPSS 0.72 | 0.72 | ||
| 10 | CVE-2015-2545Malformed EPS File | Microsoft Office | Patch this weekEPSS 0.86 | 0.86 | ||
| 11 | CVE-2016-7193Memory Corruption | Microsoft Office | Patch this weekEPSS 0.58 | 0.58 | ||
| 12 | CVE-2017-0261Use-After-Free | Microsoft Office | Patch this weekEPSS 0.78 | 0.78 | ||
| 13 | CVE-2017-11826Remote Code Execution | Microsoft Office | Patch this weekEPSS 0.81 | 0.81 | ||
| 14 | CVE-2017-8570Remote Code Execution | Microsoft Office | Patch this weekEPSS 0.90 | 0.90 | ||
| 15 | CVE-2017-0262Remote Code Execution | Microsoft Office | Patch this weekEPSS 0.81 | 0.81 | ||
| 16 | CVE-2015-1641Memory Corruption | Microsoft Office | Patch this weekEPSS 0.97 | 0.97 | ||
| 17 | CVE-2017-11774Outlook Security Feature Bypass | Microsoft Office | Patch this weekEPSS 0.60 | 0.60 | ||
| 18 | CVE-2018-0798Memory Corruption | Microsoft Office | Patch this weekEPSS 0.95 | 0.95 | ||
| 19 | CVE-2018-0802Memory Corruption | Microsoft Office | Patch this weekRansomware use; EPSS 0.93 | 0.93 | ||
| 20 | CVE-2009-0557Object Record Corruption | Microsoft Office | Patch this weekEPSS 0.53 | 0.53 | ||
| 21 | CVE-2015-1642Memory Corruption | Microsoft Office | Patch this weekEPSS 0.53 | 0.53 | ||
| 22 | CVE-2021-38646Access Connectivity Engine Remote Code Execution | Microsoft Office | Patch this weekRansomware use | 0.08 | ||
| 23 | CVE-2009-0238Remote Code Execution | Microsoft Office | Patch soon | 0.43 | ||
| 24 | CVE-2007-0671Excel Remote Code Execution | Microsoft Office | Patch soon | 0.43 | ||
| 25 | CVE-2015-1770Uninitialized Memory Use | Microsoft Office | Patch soon | 0.35 |
Added each year
Show the numbers
| Period | entries added |
|---|---|
| 2021 | 8 |
| 2022 | 14 |
| 2023 | 2 |
| 2024 | none |
| 2025 | 1 |
| 2026 | 4 |