# Microsoft Office vulnerabilities Source: https://junglewise.ai/threats/technologies/office Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/office.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 134 vulnerabilities in Microsoft Office: 10 in the last 7 days and 27 in the last 90 days, 35 of them critical and 33 exploited in the wild. The most recent, CVE-2026-124194, was published on 10 November 2026. 1 vulnerability in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 10 - Last 30 days: 11 - Last 90 days: 27 - All time: 134 (35 critical, 33 exploited in the wild) ## About Microsoft Office Integrated suite of productivity applications including word processing, spreadsheets, presentations, and other office tools. ## Latest Microsoft Office vulnerabilities - [CVE-2026-124194: Microsoft Office Outlook user warning spoofing vulnerability](https://junglewise.ai/threats/cve-2026-124194-microsoft-office-outlook-missing-user-interaction-for) (critical, exploited in the wild, CVSS 6.5, published 10 Nov 2026) - [CVE-2026-122198: Microsoft Office heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-122198-heap-based-buffer-overflow-in-microsoft-office-allows-an) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-120003: Microsoft Office heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-120003-heap-based-buffer-overflow-in-microsoft-office-allows-an) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-119998: Microsoft Office UI security feature bypass](https://junglewise.ai/threats/cve-2026-119998-product-ui-does-not-warn-user-of-unsafe-actions-in-microsoft) (medium, CVSS 6.5, published 10 Nov 2026) - [CVE-2026-116717: Microsoft Office heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-116717-heap-based-buffer-overflow-in-microsoft-office-allows-an) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-112731: Microsoft Office buffer over-read information disclosure](https://junglewise.ai/threats/cve-2026-112731-buffer-over-read-in-microsoft-office-allows-an-unauthorized) (medium, CVSS 6.5, published 10 Nov 2026) - [CVE-2026-111293: Microsoft Office buffer over-read information disclosure](https://junglewise.ai/threats/cve-2026-111293-buffer-over-read-in-microsoft-office-allows-an-unauthorized) (medium, CVSS 6.5, published 10 Nov 2026) - [CVE-2026-111291: Microsoft Office out-of-bounds read information disclosure](https://junglewise.ai/threats/cve-2026-111291-out-of-bounds-read-in-microsoft-office-allows-an-unauthorized) (medium, CVSS 6.5, published 10 Nov 2026) - [CVE-2026-111289: Microsoft Office use after free allows remote code execution](https://junglewise.ai/threats/cve-2026-111289-use-after-free-in-microsoft-office-allows-an-unauthorized) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-111286: Microsoft Office use after free remote code execution](https://junglewise.ai/threats/cve-2026-111286-use-after-free-in-microsoft-office-allows-an-unauthorized) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-108444: Microsoft Office heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-108444-heap-based-buffer-overflow-in-microsoft-office-allows-an) (high, CVSS 8.8, published 15 Oct 2026) - [CVE-2026-80091: Microsoft Office use of uninitialized resource](https://junglewise.ai/threats/cve-2026-80091-microsoft-office-use-of-uninitialized-resource) (medium, CVSS 6.5, published 8 Sep 2026) - [CVE-2026-80089: Microsoft Office out-of-bounds read information disclosure](https://junglewise.ai/threats/cve-2026-80089-microsoft-office-out-of-bounds-read-information-disclosure) (medium, CVSS 6.5, published 8 Sep 2026) - [CVE-2026-80087: Microsoft Office heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-80087-microsoft-office-heap-based-buffer-overflow) (medium, CVSS 6.5, published 8 Sep 2026) - [CVE-2026-80082: Microsoft Office out-of-bounds read](https://junglewise.ai/threats/cve-2026-80082-microsoft-office-out-of-bounds-read) (medium, CVSS 6.5, published 8 Sep 2026) - [CVE-2026-80078: Microsoft Office out-of-bounds read](https://junglewise.ai/threats/cve-2026-80078-microsoft-office-out-of-bounds-read) (medium, CVSS 6.5, published 8 Sep 2026) - [CVE-2026-80076: Microsoft Office out-of-bounds read in memory parsing](https://junglewise.ai/threats/cve-2026-80076-microsoft-office-out-of-bounds-read-in-memory-parsing) (medium, CVSS 6.5, published 8 Sep 2026) - [CVE-2026-78524: Microsoft Office out-of-bounds write in document handling](https://junglewise.ai/threats/cve-2026-78524-microsoft-office-out-of-bounds-write-in-document-handling) (high, CVSS 8.8, published 8 Sep 2026) - [CVE-2026-78510: Microsoft Office heap-based buffer overflow allows code execution](https://junglewise.ai/threats/cve-2026-78510-microsoft-office-heap-based-buffer-overflow-allows-code-execution) (high, CVSS 8.4, published 8 Sep 2026) - [CVE-2026-78505: Microsoft Office heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-78505-microsoft-office-heap-based-buffer-overflow) (high, CVSS 8.8, published 8 Sep 2026) - [CVE-2026-77898: Microsoft Office heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-77898-microsoft-office-heap-based-buffer-overflow) (high, CVSS 7.5, published 8 Sep 2026) - [CVE-2026-69739: Microsoft Office out-of-bounds read information disclosure](https://junglewise.ai/threats/cve-2026-69739-microsoft-office-out-of-bounds-read-information-disclosure) (medium, CVSS 6.5, published 8 Sep 2026) - [CVE-2026-69632: Microsoft Office use-after-free in remote code execution](https://junglewise.ai/threats/cve-2026-69632-microsoft-office-use-after-free-in-remote-code-execution) (high, CVSS 8.8, published 8 Sep 2026) - [CVE-2026-69626: Microsoft Office buffer over-read information disclosure](https://junglewise.ai/threats/cve-2026-69626-microsoft-office-buffer-over-read-information-disclosure) (medium, CVSS 6.5, published 8 Sep 2026) - [CVE-2026-69442: Microsoft Office heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-69442-microsoft-office-heap-based-buffer-overflow) (high, CVSS 8.8, published 8 Sep 2026) ## Most severe Microsoft Office vulnerabilities - [CVE-2023-23397: Microsoft Office Outlook Privilege Escalation Vulnerability](https://junglewise.ai/threats/cve-2023-23397-microsoft-office-outlook-privilege-escalation-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 14 Mar 2023) - [CVE-2009-0238: Microsoft Excel remote code execution via malformed object](https://junglewise.ai/threats/cve-2009-0238-microsoft-excel-remote-code-execution-via-malformed-object) (critical, exploited in the wild, CVSS 9.3, published 14 Apr 2026) - [CVE-2009-0557: Microsoft Office Object Record Corruption Vulnerability](https://junglewise.ai/threats/cve-2009-0557-microsoft-office-object-record-corruption-vulnerability) (critical, exploited in the wild, CVSS 9.3, published 8 Jun 2022) - [CVE-2015-1671: Microsoft Windows Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2015-1671-microsoft-windows-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 9.3, published 25 May 2022) - [CVE-2010-3333: Microsoft Office Stack-based Buffer Overflow Vulnerability](https://junglewise.ai/threats/cve-2010-3333-microsoft-office-stack-based-buffer-overflow-vulnerability) (critical, exploited in the wild, CVSS 9.3, published 3 Mar 2022) - [CVE-2015-1641: Microsoft Office Memory Corruption Vulnerability](https://junglewise.ai/threats/cve-2015-1641-microsoft-office-memory-corruption-vulnerability) (critical, exploited in the wild, CVSS 9.3, published 3 Nov 2021) - [CVE-2009-0556: Microsoft PowerPoint code injection in OutlineTextRefAtom](https://junglewise.ai/threats/cve-2009-0556-microsoft-powerpoint-code-injection-in-outlinetextrefatom) (critical, exploited in the wild, CVSS 8.8, published 7 Jan 2026) - [CVE-2007-0671: Microsoft Office Excel remote code execution vulnerability](https://junglewise.ai/threats/cve-2007-0671-microsoft-office-excel-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 12 Aug 2025) - [CVE-2015-1770: Microsoft Office Uninitialized Memory Use Vulnerability](https://junglewise.ai/threats/cve-2015-1770-microsoft-office-uninitialized-memory-use-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 28 Mar 2022) - [CVE-2012-1856: Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2012-1856-microsoft-office-mscomctl-ocx-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 3 Mar 2022) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 16 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 10 | 1 | 1 | ## Other Microsoft technologies - [Microsoft Windows](https://junglewise.ai/threats/technologies/windows): 2,362 vulnerabilities - [Microsoft Windows 10](https://junglewise.ai/threats/technologies/windows-10): 589 vulnerabilities - [Microsoft Windows 11 24h2](https://junglewise.ai/threats/technologies/windows-11-24h2): 565 vulnerabilities - [Microsoft Windows 11 25h2](https://junglewise.ai/threats/technologies/windows-11-25h2): 534 vulnerabilities - [Microsoft Windows Server 2025](https://junglewise.ai/threats/technologies/windows-server-2025): 534 vulnerabilities - [Microsoft Windows Server 2022](https://junglewise.ai/threats/technologies/windows-server-2022): 528 vulnerabilities - [Microsoft Windows Server 2019](https://junglewise.ai/threats/technologies/windows-server-2019): 521 vulnerabilities - [Microsoft Windows Server 2012](https://junglewise.ai/threats/technologies/windows-server-2012): 517 vulnerabilities - [Microsoft Windows 11](https://junglewise.ai/threats/technologies/windows-11): 494 vulnerabilities - [Microsoft Windows Server 2016](https://junglewise.ai/threats/technologies/windows-server-2016): 476 vulnerabilities - [Microsoft Windows 10 1809](https://junglewise.ai/threats/technologies/windows-10-1809): 380 vulnerabilities - [Microsoft Windows 10 21h2](https://junglewise.ai/threats/technologies/windows-10-21h2): 373 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Microsoft Office vulnerabilities", https://junglewise.ai/threats/technologies/office, 12 November 2026.