Office
Vendor:
First CVE: Jan 1, 1999 · Active for 27 years
1,033
Total CVEs
More Total CVEs than 100% of tracked products
36.9
Avg CVEs / Year
Higher CVE frequency than 99% of tracked products
7.9
Avg CVSS
Higher Avg CVSS than 68% of tracked products
3.5%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Office over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jan 1, 1999
27 years ago
Most Recent CVE
Jul 14, 2026
10 days ago
CVE Severity & Scoring
Office1,033 CVEs
16%
82%
All CVEs352,231 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local547 (53.0%)
Network158 (15.3%)
Unknown328 (31.8%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low677 (65.5%)
High28 (2.7%)
Unknown328 (31.8%)
User Interaction
None97 (9.4%)
Unknown328 (31.8%)
Required608 (58.9%)
Privileges Required
Low66 (6.4%)
High1 (0.1%)
None638 (61.8%)
Unknown328 (31.8%)
Top CVEs
Signals from CVEs in this product scope (1033 CVEs).
1,033 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2017-11882HIGH Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code | Nov 15, 2017 | 7.8 | 98 | YES | YES |
CVE-2017-0199HIGH Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows | Apr 12, 2017 | 7.8 | 98 | YES | YES |
CVE-2012-0158HIGH The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Go | Apr 10, 2012 | 8.8 | 98 | YES | YES |
CVE-2013-3906HIGH GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Bas | Nov 6, 2013 | 7.8 | 97 | YES | YES |
CVE-2012-1889HIGH Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (me | Jun 13, 2012 | 8.8 | 97 | YES | YES |
CVE-2010-3333HIGH Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format C | Nov 10, 2010 | 7.8 | 97 | YES | YES |
CVE-2009-3129HIGH Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Vi | Nov 11, 2009 | 7.8 | 97 | YES | YES |
CVE-2023-23397CRITICAL Microsoft Outlook Elevation of Privilege Vulnerability | Mar 14, 2023 | 9.8 | 96 | YES | NO |
CVE-2017-8570HIGH Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CVE | Jul 11, 2017 | 7.8 | 96 | YES | YES |
CVE-2014-1761HIGH Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Serv | Mar 25, 2014 | 7.8 | 96 | YES | YES |
Exploit Exposure
Signals from CVEs in this product scope (1033 CVEs).
CISA KEV
36 CVEs
3.5% of CVEs· 97th percentile
Metasploit
15 CVEs
1.5% of CVEs· 96th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
104 CVEs
10.1% of CVEs· 89th percentile
Social Chatter
Signals from CVEs in this product scope (1033 CVEs).
Media Mentions
Signals from CVEs in this product scope (1033 CVEs).
Top CNAs Publishing CVEs For Office
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| xp | 118 | 8.6 | 31.9% | 5 | 19 |
| x | 1 | 9.3 | 15.5% | 0 | 0 |
| v.x | 21 | 7.7 | 27.2% | 0 | 3 |
| 98 | 2 | 3.4 | 1.8% | 0 | 0 |
| 97 | 1 | 7.2 | 1.9% | 0 | 0 |
| 2024 | 6 | 6.8 | 0.5% | 0 | 0 |
| 2021 | 1 | 5.5 | 0.5% | 0 | 0 |
| 2019 | 507 | 7.6 | 4.5% | 8 | 16 |
| 2016 | 294 | 7.6 | 12.3% | 15 | 10 |
| 2013_rt | 8 | 7.2 | 4.0% | 0 | 0 |
| 2013 | 178 | 7.6 | 12.9% | 15 | 10 |
| 2011 | 41 | 8.4 | 25.5% | 4 | 5 |
| 2010 | 258 | 7.8 | 21.0% | 19 | 35 |
| 2008 | 99 | 9.1 | 29.8% | 5 | 12 |
| 2007_sp1 | 5 | 9.3 | 33.3% | 0 | 0 |
| 2007 | 152 | 8.3 | 29.4% | 16 | 36 |
| 2004 | 148 | 9.1 | 29.9% | 6 | 25 |
| 2003 | 122 | 8.6 | 32.4% | 10 | 23 |
| 2001 | 7 | 8.1 | 22.8% | 0 | 0 |
| 2000 | 84 | 8.4 | 30.5% | 4 | 13 |