Security Vulnerabilities
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS Score
8.8
EPSS Score
0.006
Published
2026-09-08
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
CVSS Score
6.5
EPSS Score
0.009
Published
2026-09-08
A remote code execution vulnerability exists when Microsoft Office improperly validates input before loading dynamic link library (DLL) files. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
To exploit the vulnerability, an attacker must first convince a user to open a specially crafted Office document.
The updates address the vulnerability by correcting how Office validates input before loading DLL files.
CVSS Score
9.8
EPSS Score
0.01
Published
2026-09-08
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS Score
8.8
EPSS Score
0.008
Published
2026-09-08
Buffer over-read in Windows Storage allows an unauthorized attacker to disclose information with a physical attack.
CVSS Score
4.3
EPSS Score
0.005
Published
2026-09-08
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
CVSS Score
6.5
EPSS Score
0.007
Published
2026-09-08
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
CVSS Score
6.5
EPSS Score
0.009
Published
2026-09-08
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS Score
8.8
EPSS Score
0.006
Published
2026-09-08
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
CVSS Score
8.8
EPSS Score
0.008
Published
2026-09-08
Improper null termination in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
CVSS Score
5.5
EPSS Score
0.005
Published
2026-09-08