Known vulnerabilities in Office Online Server

Vendor: Microsoft
Software: Office Online Server
Software CPE: cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*
Website: https://www.microsoft.com
Total vulnerabilities: 222
Public exploits: 7
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Office Online Server Office Online Server is affected by 222 known vulnerabilities: 1 critical, 170 high, 31 medium, 20 low Critical High Medium Low

Vulnerabilities (222)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU148304 - Out-of-bounds read
CVE-2026-81956		 CWE-125 High
No
No
 16.0.10417.20207 09.09.2026 SB2026090916
#VU148295 - Heap-based Buffer Overflow
CVE-2026-81947		 CWE-122 High
No
No
 16.0.10417.20207 09.09.2026 SB2026090916
#VU148294 - Type confusion
CVE-2026-81401		 CWE-843 Medium
No
No
 16.0.10417.20207 09.09.2026 SB2026090916
#VU148283 - Out-of-bounds read
CVE-2026-81390		 CWE-125 Medium
No
No
 16.0.10417.20207 09.09.2026 SB2026090916
#VU138230 - Heap-based Buffer Overflow
CVE-2026-55053		 CWE-122 High
No
No
 16.0.10417.20175 17.07.2026 SB2026071713
#VU138229 - Heap-based Buffer Overflow
CVE-2026-55137		 CWE-122 High
No
No
 16.0.10417.20175 17.07.2026 SB2026071713
#VU138226 - Out-of-bounds read
CVE-2026-55058		 CWE-125 High
No
No
 16.0.10417.20175 17.07.2026 SB2026071713
#VU138225 - Heap-based Buffer Overflow
CVE-2026-55037		 CWE-122 High
No
No
 16.0.10417.20175 17.07.2026 SB2026071713
#VU138224 - Out-of-bounds read
CVE-2026-55054		 CWE-125 Medium
No
No
 16.0.10417.20175 17.07.2026 SB2026071713
#VU138222 - Out-of-bounds read
CVE-2026-55044		 CWE-125 High
No
No
 16.0.10417.20175 17.07.2026 SB2026071713
#VU138221 - Buffer over-read
CVE-2026-55036		 CWE-126 High
No
No
 16.0.10417.20175 17.07.2026 SB2026071713
#VU138218 - Stack-based buffer overflow
CVE-2026-55141		 CWE-121 High
No
No
 16.0.10417.20175 17.07.2026 SB2026071713
#VU138217 - Untrusted Pointer Dereference
CVE-2026-55136		 CWE-822 High
No
No
 16.0.10417.20175 17.07.2026 SB2026071713
#VU138186 - Use After Free
CVE-2026-47642		 CWE-416 High
No
No
 16.0.10417.20175 17.07.2026 SB2026071713
#VU138184 - Heap-based Buffer Overflow
CVE-2026-58618		 CWE-122 High
No
No
 16.0.10417.20175 17.07.2026 SB2026071713
#VU138182 - Use After Free
CVE-2026-55948		 CWE-416 High
No
No
 16.0.10417.20175 17.07.2026 SB2026071713
#VU138181 - Stack-based buffer overflow
CVE-2026-55899		 CWE-121 High
No
No
 16.0.10417.20175 17.07.2026 SB2026071713
#VU138180 - Out-of-bounds read
CVE-2026-54988		 CWE-125 Low
No
No
 16.0.10417.20175 17.07.2026 SB2026071713
#VU138179 - Heap-based Buffer Overflow
CVE-2026-50678		 CWE-122 Low
No
No
 16.0.10417.20175 17.07.2026 SB2026071713
#VU138178 - Heap-based Buffer Overflow
CVE-2026-50675		 CWE-122 High
No
No
 16.0.10417.20175 17.07.2026 SB2026071713


Showing elements 1 - 20 out of 222