Main Vulnerability Database SB2026101422

SB2026101422 - Multiple vulnerabilities in Microsoft Office

Published: October 14, 2026 Updated: November 11, 2026

Security Bulletin ID SB2026101422

CSH Severity

High

Patch available

YES

Number of vulnerabilities 126

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 126 vulnerabilities.

1) Stack-based buffer overflow (CVE-ID: CVE-2026-83891)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a stack-based buffer overflow in Microsoft Office Word when processing a specially crafted file. A remote attacker can trick a victim into opening the file to execute arbitrary code.

The Preview Pane is not an attack vector.

2) Use-after-free (CVE-ID: CVE-2026-85340)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Microsoft Office Click-To-Run when operating locally. A local user can trigger the use-after-free to escalate privileges to SYSTEM.

The Preview Pane is not an attack vector for this vulnerability.

3) Deserialization of Untrusted Data (CVE-ID: CVE-2026-85900)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to deserialization of untrusted data in Microsoft Office SharePoint when processing untrusted serialized data. A remote user can supply untrusted serialized data over the network to execute arbitrary code.

Exploitation requires at least Site Member permissions. The Preview Pane is not an attack vector.

4) Path traversal (CVE-ID: CVE-2026-85932)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to path traversal in Microsoft Office SharePoint when handling pathnames. A remote user can read files outside the restricted directory to disclose sensitive information.

The Preview Pane is not an attack vector for this vulnerability.

5) Use-after-free (CVE-ID: CVE-2026-88109)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Microsoft Office Click-To-Run when used locally. A local user can exploit this memory management flaw to escalate privileges to SYSTEM.

6) Use-after-free (CVE-ID: CVE-2026-88144)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Office PowerPoint when processing malicious Office files. A remote attacker can send a specially crafted Office file and convince the victim to open it to execute arbitrary code.

The Preview Pane is also an attack vector.

7) Heap-based buffer overflow (CVE-ID: CVE-2026-88145)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a malicious Office file and convince the victim to open it to execute arbitrary code.

The Preview Pane is also an attack vector.

8) Use of uninitialized resource (CVE-ID: CVE-2026-88150)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use of an uninitialized resource in Microsoft Office Word when processing a specially crafted file. A remote attacker can trick a victim into opening the crafted file to execute arbitrary code.

The Preview Pane is not an attack vector.

9) Out-of-bounds read (CVE-ID: CVE-2026-88151)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when the vulnerability is triggered over a network. A remote attacker can read small portions of heap memory to disclose sensitive information.

Exploitation requires user interaction. The Preview Pane is not an attack vector.

10) Out-of-bounds read (CVE-ID: CVE-2026-88153)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose small portions of heap memory.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when processing data. A remote attacker can trigger the out-of-bounds read over a network to disclose small portions of heap memory.

Exploitation requires user interaction. The Preview Pane is not an attack vector.

11) Out-of-bounds read (CVE-ID: CVE-2026-88154)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read small portions of heap memory.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when processing document content. A remote attacker can trigger an out-of-bounds read to read small portions of heap memory.

The Preview Pane is an attack vector. User interaction is required.

12) Heap-based buffer overflow (CVE-ID: CVE-2026-88155)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office SharePoint when handling network-based operations. A remote user can trigger the buffer overflow over the network to execute arbitrary code.

Exploitation requires Manage List permissions. The Preview Pane is not an attack vector.

13) Stack-based buffer overflow (CVE-ID: CVE-2026-88156)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a stack-based buffer overflow in Microsoft Office Outlook when rendering email messages in the Reading Pane. A remote attacker can send a specially crafted email message to a target user to execute arbitrary code.

Exploitation does not require the recipient to open the message, click its contents, or otherwise interact with it.

14) Integer overflow (CVE-ID: CVE-2026-88163)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to integer overflow or wraparound in Microsoft Office SharePoint when handling network-based interactions. A remote user can exploit the integer overflow over the network to execute arbitrary code.

Exploitation requires Manage List permissions. The Preview Pane is not an attack vector.

15) Stack-based buffer overflow (CVE-ID: CVE-2026-88166)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to integer overflow or wraparound and a stack-based buffer overflow in Microsoft Office SharePoint when accessed over a network. A remote user can exploit the vulnerability over the network to execute arbitrary code.

Exploitation requires Manage List permissions. The Preview Pane is not an attack vector.

16) Buffer over-read (CVE-ID: CVE-2026-88167)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to a buffer over-read in Microsoft Office Word when processing data. A remote attacker can trigger the buffer over-read over a network to read small portions of heap memory.

User interaction is required. The Preview Pane is not an attack vector.

17) Out-of-bounds read (CVE-ID: CVE-2026-88169)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read small portions of heap memory.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Word when processing content. A remote attacker can exploit the out-of-bounds read over a network to read small portions of heap memory.

User interaction is required. The Preview Pane is an attack vector.

18) Out-of-bounds read (CVE-ID: CVE-2026-88172)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read small portions of heap memory.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when processing input. A remote attacker can trigger the out-of-bounds read over a network to read small portions of heap memory.

User interaction is required. The Preview Pane is not an attack vector.

19) Out-of-bounds read (CVE-ID: CVE-2026-88175)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read small portions of heap memory.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when processing content. A remote attacker can exploit this memory read over a network to read small portions of heap memory.

User interaction is required. The Preview Pane is an attack vector.

20) Use-after-free (CVE-ID: CVE-2026-88178)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Office PowerPoint when processing presentations. A remote attacker can submit a specially crafted presentation to an affected Office Online service to execute arbitrary code.

No user interaction is required. The Preview Pane is also an attack vector.

21) Out-of-bounds read (CVE-ID: CVE-2026-88183)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read small portions of heap memory.

The vulnerability exists due to an out-of-bounds read in Microsoft Office PowerPoint when processing data. A remote attacker can exploit the out-of-bounds read over a network to read small portions of heap memory.

Exploitation requires user interaction. The Preview Pane is not an attack vector.

22) Out-of-bounds read (CVE-ID: CVE-2026-88184)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read small portions of heap memory.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when accessing heap memory. A remote attacker can exploit the out-of-bounds read over a network to read small portions of heap memory.

Exploitation requires user interaction. The Preview Pane is not an attack vector.

23) Heap-based buffer overflow (CVE-ID: CVE-2026-88185)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Word when processing content received over a network. A remote attacker can exploit the overflow over a network to execute arbitrary code.

The Preview Pane is an attack vector, and no user interaction is required. Successful exploitation requires a deep understanding of the system and manipulation of its components to trigger a specific condition.

24) Heap-based buffer overflow (CVE-ID: CVE-2026-88186)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Word when processing specially crafted files. A remote attacker can trick a victim into opening a specially crafted file to execute arbitrary code.

The Preview Pane is not an attack vector.

25) Out-of-bounds read (CVE-ID: CVE-2026-88190)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read small portions of heap memory.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when processing content. A remote attacker can exploit the out-of-bounds read over a network to read small portions of heap memory.

User interaction is required. The Preview Pane is not an attack vector.

26) Out-of-bounds read (CVE-ID: CVE-2026-88192)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read small portions of heap memory.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when processing input. A remote attacker can exploit the out-of-bounds read over a network to read small portions of heap memory.

User interaction is required. The Preview Pane is not an attack vector.

27) Buffer over-read (CVE-ID: CVE-2026-88195)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read small portions of heap memory.

The vulnerability exists due to a buffer over-read in Microsoft Office Excel when processing data. A remote attacker can exploit the vulnerability over a network to read small portions of heap memory.

Exploitation requires user interaction. The Preview Pane is not an attack vector.

28) Heap-based buffer overflow (CVE-ID: CVE-2026-88196)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office when processing a malicious Office file. A remote attacker can send a specially crafted Office file and convince a user to open it to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

29) Heap-based buffer overflow (CVE-ID: CVE-2026-88197)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office when opening malicious Office files. A remote attacker can send a malicious Office file and convince a user to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

30) Missing Authorization (CVE-ID: CVE-2026-88198)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to escalate privileges and overwrite arbitrary file content in the security context of the local system.

The vulnerability exists due to missing authorization in Microsoft Office SharePoint when handling requests for operations beyond the permissions granted to a user's account. A remote user can send a specially crafted request to an affected SharePoint server to escalate privileges and overwrite arbitrary file content in the security context of the local system.

No additional user interaction is required. The Preview Pane is not an attack vector.

31) Privilege Context Switching Error (CVE-ID: CVE-2026-88200)

CWE-ID: CWE-270 - Privilege Context Switching Error

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to escalate privileges and overwrite arbitrary file content in the security context of the local system.

The vulnerability exists due to a privilege context switching error in Microsoft Office SharePoint when handling specially crafted requests. A remote user can send a specially crafted request to perform an operation beyond their account permissions to escalate privileges and overwrite arbitrary file content in the security context of the local system.

No additional user interaction is required. The Preview Pane is not an attack vector.

32) Buffer over-read (CVE-ID: CVE-2026-88201)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read small portions of heap memory.

The vulnerability exists due to a buffer over-read in Microsoft Office Excel when processing data. A remote attacker can exploit this issue over a network to read small portions of heap memory.

Exploitation requires user interaction. The Preview Pane is not an attack vector.

33) Heap-based buffer overflow (CVE-ID: CVE-2026-88202)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Word when processing a specially crafted file. A remote attacker can trick a user into opening the file to execute arbitrary code.

The Preview Pane is not an attack vector.

34) Untrusted Pointer Dereference (CVE-ID: CVE-2026-88203)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an untrusted pointer dereference in Microsoft Office PowerPoint when processing content. A remote attacker can trigger the untrusted pointer dereference over a network to disclose small portions of heap memory.

User interaction is required. The Preview Pane is an attack vector.

35) Cross-site scripting (CVE-ID: CVE-2026-88204)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote user to access or modify SharePoint data available to another user.

The vulnerability exists due to cross-site scripting in SharePoint page content rendering when generating web pages containing user-supplied content. A remote user can store malicious script content in a page to access or modify SharePoint data available to another user.

Exploitation requires permission to add or modify page content and another user to view and interact with the affected content. The script runs in that user's security context. The Preview Pane is not an attack vector.

36) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-88206)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to escalate privileges to SYSTEM.

The vulnerability exists due to server-side request forgery in Microsoft Office SharePoint when handling network requests. A remote user can trigger server-side requests to escalate privileges to SYSTEM.

Successful exploitation requires specific conditions, such as particular protocol settings or configurations. The Preview Pane is not an attack vector.

37) Heap-based buffer overflow (CVE-ID: CVE-2026-88207)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office PowerPoint when processing content. A remote attacker can exploit the Preview Pane attack vector to execute arbitrary code.

User interaction is required. Successful exploitation requires a deep understanding of the system and the ability to manipulate its components to trigger a specific condition.

38) Cross-site scripting (CVE-ID: CVE-2026-88208)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote user to access or modify SharePoint data available to another user.

The vulnerability exists due to improper neutralization of input during web page generation (cross-site scripting) in SharePoint page content rendering when rendering user-supplied content. A remote user can store malicious scripts in an affected page to access or modify SharePoint data available to another user.

Exploitation requires permission to add or modify content on the affected page. Another user must view and interact with the affected content, causing the script to run in that user's security context.

39) Cross-site scripting (CVE-ID: CVE-2026-88209)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote user to perform spoofing.

The vulnerability exists due to improper neutralization of input during web page generation in Microsoft Office SharePoint when generating web content. A remote user can supply input that is not properly neutralized to perform spoofing.

Exploitation requires user interaction. The Preview Pane is not an attack vector.

40) Reliance on Untrusted Inputs in a Security Decision (CVE-ID: CVE-2026-88210)

CWE-ID: CWE-807 - Reliance on Untrusted Inputs in a Security Decision

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass Office macro policies used to block untrusted or malicious files.

The vulnerability exists due to reliance on untrusted inputs in a security decision in Microsoft Office Word when evaluating inputs for macro policy enforcement. A remote attacker can supply untrusted inputs to bypass Office macro policies used to block untrusted or malicious files.

User interaction is required, and the Preview Pane is an attack vector.

41) Out-of-bounds read (CVE-ID: CVE-2026-94506)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read small portions of heap memory.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Access when processing a malicious Office file. A remote attacker can send a user a malicious Office file and convince them to open it to read small portions of heap memory.

The Preview Pane is not an attack vector.

42) Input validation error (CVE-ID: CVE-2026-96044)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to escalate privileges to SharePoint administrator.

The vulnerability exists due to an unspecified weakness in Microsoft Office SharePoint when accessing the server over a network. A remote user can execute code remotely on the SharePoint server to escalate privileges to SharePoint administrator.

Exploitation requires access to the domain. The Preview Pane is not an attack vector.

43) Stack-based buffer overflow (CVE-ID: CVE-2026-96995)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a stack-based buffer overflow in Microsoft Office Word when exploited locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

The Preview Pane is not an attack vector.

44) Heap-based buffer overflow (CVE-ID: CVE-2026-96996)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Word when processing a malicious Office file. A remote attacker can send a malicious Office file and convince the victim to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

45) Use-after-free (CVE-ID: CVE-2026-96997)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Microsoft Office OneNote when accessing freed memory. A local user can exploit this flaw locally to escalate privileges to SYSTEM.

46) Heap-based buffer overflow (CVE-ID: CVE-2026-97001)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Word when processing a malicious Office file. A remote attacker can send a specially crafted Office file and convince the victim to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

47) Heap-based buffer overflow (CVE-ID: CVE-2026-97003)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a malicious Office file to a user and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

48) Heap-based buffer overflow (CVE-ID: CVE-2026-97004)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a user a malicious Office file and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

49) Out-of-bounds read (CVE-ID: CVE-2026-97005)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose information.

The vulnerability exists due to an out-of-bounds read in Microsoft Office PowerPoint when processing content, including through the Preview Pane. A remote attacker can trigger an out-of-bounds read to read small portions of heap memory.

User interaction is required.

50) Heap-based buffer overflow (CVE-ID: CVE-2026-97007)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The Preview Pane is not an attack vector.

51) Buffer underflow (CVE-ID: CVE-2026-97008)

CWE-ID: CWE-124 - Buffer Underwrite ('Buffer Underflow')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a buffer underwrite in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a user a malicious Office file and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

52) Heap-based buffer overflow (CVE-ID: CVE-2026-97009)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a malicious Office file. A remote attacker can convince a user to open a specially crafted Office file to execute arbitrary code.

The Preview Pane is not an attack vector.

53) Use-after-free (CVE-ID: CVE-2026-97010)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a malicious Office file to a user and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

54) Use of uninitialized resource (CVE-ID: CVE-2026-97011)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use of an uninitialized resource in Microsoft Office Excel when processing Office files. A remote attacker can send a malicious Office file to a user and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

55) Stack-based buffer overflow (CVE-ID: CVE-2026-97012)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the client system.

The vulnerability exists due to a stack-based buffer overflow in Microsoft Office Outlook when processing responses from a malicious server. A remote attacker can host a malicious server and convince a user to connect to it from an affected client to execute arbitrary code on the client system.

56) Out-of-bounds read (CVE-ID: CVE-2026-97014)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when accessing heap memory. A remote attacker can read small portions of heap memory to disclose sensitive information.

Exploitation requires user interaction. The Preview Pane is not an attack vector.

57) Heap-based buffer overflow (CVE-ID: CVE-2026-97016)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the recipient's system.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Outlook when rendering email messages in the Outlook Reading Pane. A remote attacker can send a specially crafted email message to execute arbitrary code on the recipient's system.

Exploitation does not require the recipient to open the message or click anything in it.

58) Use-after-free (CVE-ID: CVE-2026-97017)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Office Excel when opening a malicious Office file. A remote attacker can send a malicious Office file to a user and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

59) Use-after-free (CVE-ID: CVE-2026-97738)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Office Excel when processing malicious Office files. A remote attacker can send a malicious Office file and convince the victim to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

60) Integer underflow (CVE-ID: CVE-2026-97739)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to integer underflow in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a malicious Office file and convince a user to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

61) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-97740)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read portions of process memory.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a malicious Office file to a user and convince them to open it to read portions of process memory.

The Preview Pane is not an attack vector.

62) Stack-based buffer overflow (CVE-ID: CVE-2026-97742)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a stack-based buffer overflow in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a malicious Office file to a user and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

63) Out-of-bounds read (CVE-ID: CVE-2026-97744)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read small portions of heap memory.

The vulnerability exists due to an out-of-bounds read in Microsoft Office PowerPoint when previewing content. A remote attacker can trigger the vulnerability through the Preview Pane to read small portions of heap memory.

Exploitation requires user interaction.

64) Use-after-free (CVE-ID: CVE-2026-97745)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The Preview Pane is not an attack vector.

65) Integer underflow (CVE-ID: CVE-2026-97746)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to integer underflow in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a malicious Office file to a user and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

66) Use-after-free (CVE-ID: CVE-2026-97747)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Office Excel when processing malicious Office files. A remote attacker can send a malicious Office file to a user and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

67) Heap-based buffer overflow (CVE-ID: CVE-2026-97748)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a specially crafted Office file and convince a user to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

68) Double free (CVE-ID: CVE-2026-97749)

CWE-ID: CWE-415 - Double Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to double free in Microsoft Office Outlook when rendering email messages in the Reading Pane. A remote attacker can send a specially crafted email message to execute arbitrary code on the recipient's system.

Exploitation does not require the recipient to open the message or click anything in it.

69) Stack-based buffer overflow (CVE-ID: CVE-2026-97750)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The Preview Pane is not an attack vector.

70) Heap-based buffer overflow (CVE-ID: CVE-2026-97751)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

71) Use-after-free (CVE-ID: CVE-2026-97752)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a malicious Office file to a victim and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

72) Heap-based buffer overflow (CVE-ID: CVE-2026-97753)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The Preview Pane is not an attack vector.

73) Heap-based buffer overflow (CVE-ID: CVE-2026-97754)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

74) Out-of-bounds read (CVE-ID: CVE-2026-97755)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when processing malicious Office files. A remote attacker can send a malicious Office file and convince a user to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

75) Heap-based buffer overflow (CVE-ID: CVE-2026-97756)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The Preview Pane is not an attack vector.

76) Heap-based buffer overflow (CVE-ID: CVE-2026-97757)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing Office files. A remote attacker can send a malicious Office file to a user and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

77) Heap-based buffer overflow (CVE-ID: CVE-2026-97758)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The Preview Pane is not an attack vector.

78) Use-after-free (CVE-ID: CVE-2026-97759)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a malicious Office file and convince a user to open it to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

79) Out-of-bounds read (CVE-ID: CVE-2026-97760)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read portions of process memory.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a malicious Office file to a user and convince them to open it to read portions of process memory.

The Preview Pane is not an attack vector for this vulnerability.

80) Stack-based buffer overflow (CVE-ID: CVE-2026-97761)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a stack-based buffer overflow in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a malicious Office file and convince a user to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

81) Out-of-bounds write (CVE-ID: CVE-2026-97762)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a malicious Office file to a user and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

82) Heap-based buffer overflow (CVE-ID: CVE-2026-97763)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The Preview Pane is not an attack vector.

83) Heap-based buffer overflow (CVE-ID: CVE-2026-97765)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The Preview Pane is not an attack vector.

84) Heap-based buffer overflow (CVE-ID: CVE-2026-97766)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a malicious Office file and convince a user to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

85) Double free (CVE-ID: CVE-2026-97767)

CWE-ID: CWE-415 - Double Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to double free in Microsoft Office Excel when opening a malicious Office file. A remote attacker can send a malicious Office file to a user and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

86) Heap-based buffer overflow (CVE-ID: CVE-2026-97768)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing malicious Office files. A remote attacker can send a malicious Office file to a user and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

87) Heap-based buffer overflow (CVE-ID: CVE-2026-97769)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The Preview Pane is not an attack vector.

88) Stack-based buffer overflow (CVE-ID: CVE-2026-97770)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The Preview Pane is not an attack vector.

89) Use-after-free (CVE-ID: CVE-2026-97771)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening the file to execute arbitrary code.

The Preview Pane is not an attack vector.

90) Double free (CVE-ID: CVE-2026-97772)

CWE-ID: CWE-415 - Double Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to double free in Microsoft Office Excel when processing malicious Office files. A remote attacker can send a malicious Office file to a user and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

91) Heap-based buffer overflow (CVE-ID: CVE-2026-97773)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing malicious Office files. A remote attacker can send a malicious Office file and convince a user to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

92) Use-after-free (CVE-ID: CVE-2026-97775)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The Preview Pane is not an attack vector.

93) Heap-based buffer overflow (CVE-ID: CVE-2026-97776)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The Preview Pane is not an attack vector.

94) Heap-based buffer overflow (CVE-ID: CVE-2026-97777)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The Preview Pane is not an attack vector.

95) Integer overflow (CVE-ID: CVE-2026-97778)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to integer overflow or wraparound in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a malicious Office file and convince the victim to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

96) Out-of-bounds read (CVE-ID: CVE-2026-97779)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose portions of process memory.

The Preview Pane is not an attack vector.

97) Heap-based buffer overflow (CVE-ID: CVE-2026-97780)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a malicious Office file. A remote attacker can trick a user into opening a malicious Office file to execute arbitrary code.

The Preview Pane is not an attack vector.

98) Heap-based buffer overflow (CVE-ID: CVE-2026-108426)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the affected system.

The Preview Pane is not an attack vector for this vulnerability.

99) Heap-based buffer overflow (CVE-ID: CVE-2026-108427)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The Preview Pane is not an attack vector.

100) Heap-based buffer overflow (CVE-ID: CVE-2026-108428)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the affected system.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Word when processing a specially crafted file. A remote attacker can trick a user into opening such a file to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

101) Heap-based buffer overflow (CVE-ID: CVE-2026-108429)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the affected system.

The Preview Pane is not an attack vector for this vulnerability.

102) Heap-based buffer overflow (CVE-ID: CVE-2026-108430)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in the victim user's context.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Word when processing a specially crafted document using Word's numbering features. A remote attacker can send a specially crafted Word document and convince a user to open it and use the numbering features to execute arbitrary code in the user's context.

The Preview Pane is not an attack vector for this vulnerability.

103) Stack-based buffer overflow (CVE-ID: CVE-2026-108431)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in the victim user's context.

The vulnerability exists due to a stack-based buffer overflow in Microsoft Office Word when processing a specially crafted document using Word's numbering features. A remote attacker can send a specially crafted Word document and convince a user to open it and use the numbering features to execute arbitrary code in the user's context.

The Preview Pane is not an attack vector for this vulnerability.

104) Heap-based buffer overflow (CVE-ID: CVE-2026-108432)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in the victim user's context.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Word when processing a specially crafted document using Word's numbering features. A remote attacker can send a crafted Word document and convince a user to open it and use the numbering features to execute arbitrary code in that user's context.

The Preview Pane is not an attack vector for this vulnerability.

105) Reliance on Untrusted Inputs in a Security Decision (CVE-ID: CVE-2026-108433)

CWE-ID: CWE-807 - Reliance on Untrusted Inputs in a Security Decision

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass OLE security protections in Microsoft Office.

The vulnerability exists due to reliance on untrusted inputs in a security decision in Microsoft Office Word when processing a malicious Office file. A remote attacker can send a specially crafted Office file and convince a user to open it to bypass protections against vulnerable COM/OLE controls.

The Preview Pane is not an attack vector for this vulnerability.

106) Out-of-bounds read (CVE-ID: CVE-2026-108434)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, potentially including small portions of heap memory.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Word when processing attacker-controlled input. A remote attacker can supply specially crafted input that requires user interaction to trigger reads beyond the intended memory boundaries and potentially disclose small portions of heap memory.

The Preview Pane is not an attack vector for this vulnerability.

107) Untrusted Pointer Dereference (CVE-ID: CVE-2026-108435)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information from process memory.

The vulnerability exists due to an untrusted pointer dereference in Microsoft Office Word when processing untrusted input. A remote attacker can induce a user to process specially crafted input to potentially read portions of process memory.

The Preview Pane is not an attack vector for this vulnerability.

108) Out-of-bounds read (CVE-ID: CVE-2026-108436)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Word when processing attacker-controlled content. A remote attacker can induce a victim to process specially crafted content to potentially read small portions of heap memory.

The Preview Pane is not an attack vector for this vulnerability.

109) Heap-based buffer overflow (CVE-ID: CVE-2026-108437)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the affected system.

The Preview Pane is not an attack vector for this vulnerability.

110) Heap-based buffer overflow (CVE-ID: CVE-2026-108439)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in the victim user's context.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Word when processing RTF files. A remote attacker can trick a user into opening a malicious RTF file or viewing it in the Preview Pane to execute arbitrary code in the user's context.

111) Stack-based buffer overflow (CVE-ID: CVE-2026-108440)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in the victim user's context.

The vulnerability exists due to a stack-based buffer overflow in Microsoft Office Word when processing a malicious RTF file. A remote attacker can craft an RTF file and induce a user to open it or render it in the preview pane to execute arbitrary code in the user's context.

112) Heap-based buffer overflow (CVE-ID: CVE-2026-108441)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in the user's context.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Word when processing a specially crafted document using the Phonetic Guide feature. A remote attacker can send such a document and convince a user to open it in Microsoft Word and use the Phonetic Guide feature to execute arbitrary code in the user's context.

The Preview Pane is not an attack vector for this vulnerability.

113) Use-after-free (CVE-ID: CVE-2026-108442)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in the victim user's context.

The vulnerability exists due to use-after-free in Microsoft Office Word when processing a specially crafted document. A remote attacker can send such a document and convince a user to open it in Word and delete a row to execute arbitrary code in the user's context.

The Preview Pane is not an attack vector for this vulnerability.

114) Off-by-one (CVE-ID: CVE-2026-108443)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in the victim user's context.

The vulnerability exists due to an off-by-one error in Microsoft Office Word when processing document numbering features. A remote attacker can send a specially crafted Word document and convince a user to open it and use Word's numbering features to execute arbitrary code in that user's context.

The Preview Pane is not an attack vector for this vulnerability.

115) Heap-based buffer overflow (CVE-ID: CVE-2026-108444)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in the user's context.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office when processing a specially crafted file opened in Microsoft Excel and saved as a web page. A remote attacker can send a specially crafted file and convince a user to open it in Excel and save it as a web page to execute arbitrary code in the user's context.

116) Stack-based buffer overflow (CVE-ID: CVE-2026-108445)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in the victim user's context.

The vulnerability exists due to a stack-based buffer overflow in Microsoft Office Word when processing specially crafted documents. A remote attacker can send a specially crafted document and convince a user to open it in Microsoft Word and accept a prompt to update its form fields to execute arbitrary code in that user's context.

The Preview Pane is not an attack vector for this vulnerability.

117) Use-after-free (CVE-ID: CVE-2026-108446)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the affected system.

The vulnerability exists due to use-after-free in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a user into opening the file to execute arbitrary code on the affected system.

The Preview Pane is not an attack vector.

118) Heap-based buffer overflow (CVE-ID: CVE-2026-108447)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the affected system.

The Preview Pane is not an attack vector for this vulnerability.

119) Heap-based buffer overflow (CVE-ID: CVE-2026-108448)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the affected system.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Outlook when processing crafted content, including content displayed in the Preview Pane. A remote attacker can induce a user to preview specially crafted content to execute arbitrary code on the affected system.

120) Heap-based buffer overflow (CVE-ID: CVE-2026-108449)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in the victim user's context.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Word when processing a specially crafted document opened and saved in OpenDocument Text format. A remote attacker can send a specially crafted document and convince a user to open it in Microsoft Word and save it in OpenDocument Text format to execute arbitrary code in the user's context.

The Preview Pane is not an attack vector for this vulnerability.

121) Heap-based buffer overflow (CVE-ID: CVE-2026-108450)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the affected system.

The Preview Pane is not an attack vector for this vulnerability.

122) Numeric Truncation Error (CVE-ID: CVE-2026-108451)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the affected system.

The vulnerability exists due to a numeric truncation error in Microsoft Office Word when processing specially crafted files. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

123) Out-of-bounds read (CVE-ID: CVE-2026-108453)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose information from heap memory.

The vulnerability exists due to an out-of-bounds read in Microsoft Office PowerPoint when processing presentation content. A remote attacker can trick a victim into previewing specially crafted presentation content to read small portions of heap memory.

124) Buffer over-read (CVE-ID: CVE-2026-108454)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information from heap memory.

The vulnerability exists due to a buffer over-read in Microsoft Office PowerPoint when processing content. A remote attacker can trick a victim into processing specially crafted content to potentially read small portions of heap memory.

The Preview Pane is an attack vector for this vulnerability.

125) Out-of-bounds read (CVE-ID: CVE-2026-108455)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Microsoft Office PowerPoint when processing crafted presentation content. A remote attacker can trick a victim into opening a specially crafted presentation to read small portions of heap memory.

The Preview Pane is also an attack vector.

126) Heap-based buffer overflow (CVE-ID: CVE-2026-120005)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the victim's system.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office PowerPoint when processing a specially crafted file. A remote attacker can trick a user into opening the file to execute arbitrary code.

Remediation

Install update from vendor's website.

SB2026101422 - Multiple vulnerabilities in Microsoft Office

Breakdown by Severity

Description

Remediation

References

Please verify you're human