office security

Microsoft has patched CVE-2026-50678, a Microsoft Excel heap-based buffer overflow that can expose information and disrupt the application when a user interacts with malicious content. Released on July 14, 2026, the flaw affects Microsoft 365 Apps for enterprise, Excel 2016, Office 2019, Office...

CVE-2026-50675 is an Important-rated Microsoft Excel vulnerability that can let an attacker run code after a user opens malicious spreadsheet content. Microsoft published the flaw on July 14, 2026, with a CVSS 3.1 score of 7.8 and the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The apparently...

Microsoft 365 Apps for Windows version 2508, dated August 26, 2025, blocks FrontPage Remote Procedure Call file access by default, meaning Office file-open paths that still depend on FPRPC should be found and replaced before that release reaches users. Admins should inventory Office and...

Microsoft disclosed CVE-2026-45461 on June 9, 2026 as a Critical Microsoft Office remote code execution vulnerability, even though its CVSS vector lists the attack vector as local because exploitation depends on code being run on the victim’s machine. That wording is not a contradiction so much...

Microsoft labels CVE-2026-45458 as a Microsoft Outlook and Word remote code execution vulnerability because the attacker can be remote, even though CVSS scores the exploit path as local because malicious content must be opened, previewed, or otherwise processed on the victim’s machine. That...

On June 9, 2026, Microsoft published CVE-2026-44817, an Important-rated Microsoft Excel remote code execution vulnerability affecting Microsoft 365 Apps, Office 2019, Office LTSC 2021 and 2024, Office Online Server, Excel 2016, and several Mac Office editions. The bug is not a drive-by browser...

India’s Computer Emergency Response Team has warned that vulnerabilities in Microsoft Office could expose affected users to arbitrary code execution, information theft, denial of service, and cloud-service disruption, while Microsoft has already released updates for the Office apps and users are...

Microsoft disclosed CVE-2026-40361, a Microsoft Word remote code execution vulnerability, in its Security Update Guide on May 12, 2026, warning that the bug is serious enough to merit patching even though public technical detail remains limited. That combination — a confirmed vendor advisory, a...

CVE-2026-40421 is a Microsoft Word information disclosure vulnerability listed in Microsoft’s Security Update Guide as of May 12, 2026, affecting the Office document-processing stack where a crafted Word file or related content can expose data that should remain unavailable to an attacker. The...

Microsoft disclosed CVE-2026-40366 on May 12, 2026, as a Critical Microsoft Word remote code execution vulnerability affecting supported Office, Word 2016, Microsoft 365 Apps for Enterprise, Office LTSC, Office 2019, and Office for Mac releases, with official fixes available through Microsoft’s...

Microsoft disclosed CVE-2026-40363 on May 12, 2026, as a Critical Microsoft Office remote code execution vulnerability caused by a heap-based buffer overflow, affecting Microsoft 365 Apps, Office 2016, Office 2019, Office LTSC 2021 and 2024, Office for Mac, and Office for Android. The...

Microsoft’s CVE-2026-33822 entry for Microsoft Word Information Disclosure Vulnerability is a good example of why vendor metadata matters as much as the CVE label itself. The public record may be sparse on exploit mechanics, but Microsoft’s own framing tells defenders that the issue is real...

Microsoft shipped fixes for two recently disclosed critical Microsoft Office vulnerabilities—CVE‑2026‑26110 and CVE‑2026‑26113—that can lead to arbitrary code execution when a crafted file is processed locally, and defenders should treat these updates as high priority because the Outlook and...

Microsoft has released patches for two newly disclosed critical vulnerabilities in Microsoft Office—tracked as CVE-2026-26110 and CVE-2026-26113—and administrators and everyday users should treat the update as urgent: both flaws allow remote code execution in the context of the current user and...

Microsoft’s advisory for CVE-2026-26110 labels the defect as a “Remote Code Execution” (RCE) vulnerability in Microsoft Office, yet the published CVSS Attack Vector is listed as Local (AV:L) — this apparent contradiction is deliberate and explains two different questions about risk: who can...

Microsoft’s advisory for CVE-2026-26113, labeled as a “Microsoft Office Remote Code Execution Vulnerability,” has sparked confusion across security teams because the published CVSS vector lists the Attack Vector as Local (AV:L) — a seeming contradiction that deserves a careful, technical...

Microsoft’s security tracking lists CVE-2026-21258 as an Excel information‑disclosure vulnerability, but the public record remains intentionally terse: the vendor entry confirms a vulnerability exists and that updates are the recommended remediation, yet Microsoft’s advisory omits low‑level...

Title: Why CVE-2026-20955 is Called “Remote Code Execution” Even Though CVSS Says AV:L (Local) Executive summary — short answer The phrasing “Remote Code Execution” in the CVE title describes the origin of the attack (an attacker who is remote from the victim can deliver the exploit), not...

Microsoft’s advisory for CVE-2026-20955 labels the bug as a “Microsoft Excel Remote Code Execution Vulnerability,” yet the published CVSS Attack Vector for the issue is Local (AV:L) — a wording mismatch that has left many admins and vulnerability managers asking whether Microsoft misclassified...

Short answer (TL;DR) The CVE title says "Remote Code Execution" because a remote attacker can deliver a malicious Word file and cause code to run on the victim machine (attacker origin / impact). The CVSS Attack Vector = Local (AV:L) because the vulnerable code actually executes inside a local...