office security

Microsoft’s July 14, 2026 Office security updates fix CVE-2026-55035, an out-of-bounds read that can expose sensitive information when a user interacts with malicious content. The vulnerability affects Microsoft 365 Apps for enterprise, supported perpetual Office releases, Office for Mac, and...

CVE-2026-55141 is a Microsoft Excel code-execution vulnerability that requires a user to open or otherwise process malicious content on the affected device. That requirement gives it a Local attack vector in CVSS, even though Microsoft classifies the security impact as remote code execution...

CVE-2026-55136 is a high-severity Microsoft Excel remote code execution vulnerability fixed in Microsoft’s July 14, 2026 security updates, affecting Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC, Office for Mac, and Office Online Server. Organizations should deploy the...

Microsoft has patched CVE-2026-55127, a critical Microsoft Word remote code execution vulnerability that can be triggered when a user opens—or potentially previews—a malicious document. The heap-based buffer overflow carries a CVSS 3.1 score of 7.8 and affects Microsoft 365 Apps for Enterprise...

Microsoft has patched CVE-2026-55138, a Microsoft Excel information-disclosure vulnerability that can expose sensitive data when a user interacts with malicious content. Released on July 14, 2026, the flaw affects Microsoft 365 Apps for enterprise, Excel 2016, Office 2019, Office LTSC editions...

CVE-2026-55041 is a high-severity Microsoft Excel vulnerability that can let an attacker run arbitrary code after a crafted file is processed on the target device. Microsoft calls it a “Remote Code Execution Vulnerability,” even though its CVSS 3.1 vector begins with AV:L, because the title...

CVE-2026-55050 exposes information through an out-of-bounds read in Microsoft Word, affecting Microsoft 365 Apps, Office 2019, Office LTSC editions, Word 2016, Office for Mac, and Word components used by supported SharePoint Server releases. Microsoft fixed the vulnerability in its July 14, 2026...

CVE-2026-55039 is an important-severity Microsoft Excel vulnerability that can let malicious workbook content execute code on a user’s computer, but its CVSS attack vector is Local (AV:L) because exploitation occurs only after the file reaches that computer and is opened there. The apparent...

CVE-2026-55031 is an Important-rated Microsoft Excel vulnerability that can let an attacker run code on a victim’s computer after the victim opens or otherwise processes malicious content. Despite Microsoft calling it a “Remote Code Execution Vulnerability,” its CVSS 3.1 vector begins with AV:L...

CVE-2026-55025 is a high-severity Microsoft Excel code-execution vulnerability that requires a malicious file or equivalent local input to reach Excel, but successful exploitation can still give a remote attacker control of code running on the victim’s computer. Microsoft published the flaw on...

Microsoft has fixed CVE-2026-55022, a Critical-rated Microsoft Office remote code execution vulnerability that could let an attacker run code after a user interacts with a malicious Office file. Released on July 14 as part of Microsoft’s July 2026 security updates, the flaw affects Microsoft 365...

Microsoft has patched CVE-2026-55018, a critical Microsoft Office remote code execution vulnerability that can let an attacker run code after a user opens malicious content. The July 14, 2026 security release covers Microsoft 365 Apps for enterprise, Office 2016, Office 2019, Office LTSC 2021...

Microsoft has patched CVE-2026-50408, an Important-rated Excel information disclosure vulnerability that can expose sensitive memory contents when a user interacts with a malicious file. The flaw affects Microsoft 365 Apps for enterprise, Excel 2016, Office 2019, Office LTSC 2021 and 2024...

Microsoft has patched CVE-2026-55024, a high-severity Microsoft Excel remote code execution vulnerability that can let an attacker run code after a user opens a malicious file. The flaw carries a CVSS 3.1 base score of 7.8 and affects Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019...

Microsoft has patched CVE-2026-48580, an Important-rated information disclosure vulnerability in Excel that can expose sensitive memory when a user interacts with malicious content. The flaw affects Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC 2021 and 2024, Office for Mac, and...

CVE-2026-47642 is an Important-severity Microsoft Excel flaw that can give an attacker code execution after the vulnerable workbook or related content is processed on the target device. Microsoft calls it a Remote Code Execution vulnerability even though its CVSS vector begins with AV:L, because...

CVE-2026-58618 is a high-severity Microsoft Excel vulnerability that can let an attacker run code after a user opens or otherwise processes a malicious file locally. Despite Microsoft calling it a “Remote Code Execution Vulnerability,” its CVSS 3.1 vector begins with AV:L, meaning exploitation...

CVE-2026-55948 is a high-severity Microsoft Excel vulnerability that can let an attacker run arbitrary code after a user opens a malicious workbook. Microsoft published the flaw on July 14, 2026, with a CVSS 3.1 score of 7.8 and the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The apparent...

CVE-2026-55899 is an Important-rated Microsoft Excel vulnerability that can let an attacker’s code run on a victim’s PC after the victim opens or otherwise processes a malicious file. The apparent contradiction in Microsoft’s advisory—remote code execution in the title but Local in the CVSS...

CVE-2026-54988 can expose a limited amount of memory from Microsoft Excel and then force the affected application or service to become unavailable. Microsoft rates the flaw 6.1, Medium, with the CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, making the availability impact considerably more...