Security feed

24 October 2026

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Office OLE DLL Side Loading Vulnerability

Microsoft Office Object Linking & Embedding (OLE) dynamic link library (DLL) contains a side loading vulnerability due to it improperly validating input before loading libraries. Successful exploitation allows for remote code execution. CISA required action: Apply updates per vendor instructions.

Office CVE-2016-3235

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2016-3235

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2016-3235
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3667 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:39:25 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Office Outlook Security Feature Bypass Vulnerability

Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands. CISA required action: Apply updates per vendor instructions.

Office CVE-2017-11774

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2017-11774

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2017-11774
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3651 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:38:30 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Office Remote Code Execution Vulnerability

Microsoft Office contains an unspecified vulnerability that allows for remote code execution. CISA required action: Apply updates per vendor instructions.

Office CVE-2021-27059

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2021-27059

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2021-27059
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3646 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:38:27 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Office Memory Corruption Vulnerability

Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user. CISA required action: Apply updates per vendor instructions.

Office CVE-2017-11882

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2017-11882

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2017-11882
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3644 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:38:26 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Office Memory Corruption Vulnerability

Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798. CISA required action: Apply updates per vendor instructions.

Office CVE-2018-0802

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2018-0802

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2018-0802
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3641 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:38:24 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Office Memory Corruption Vulnerability

Microsoft Office contains a memory corruption vulnerability due to failure to properly handle rich text format files in memory. Successful exploitation allows for remote code execution in the context of the current user. CISA required action: Apply updates per vendor instructions.

Office CVE-2015-1641

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2015-1641

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2015-1641
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3640 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:38:23 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Office Memory Corruption Vulnerability

Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0802. CISA required action: Apply updates per vendor instructions.

Office CVE-2018-0798

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2018-0798

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2018-0798
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3638 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:38:22 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Excel Security Feature Bypass

A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution. CISA required action: Apply updates per vendor instructions.

Office CVE-2021-42292

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2021-42292

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2021-42292
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2968 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:56 GMT
Publisher date: Wed, 17 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Office Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft Office. CISA required action: Apply updates per vendor instructions.

Office CVE-2017-0262

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2017-0262

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2017-0262
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2896 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:14 GMT
Publisher date: Thu, 10 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Office Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory. CISA required action: Apply updates per vendor instructions.

Office CVE-2017-8570

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2017-8570

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2017-8570
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2874 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:59 GMT
Publisher date: Fri, 25 Feb 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Office Stack-based Buffer Overflow Vulnerability

A stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office and earlier allows an attacker to perform remote code execution. CISA required action: Apply updates per vendor instructions.

Office CVE-2010-3333

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2010-3333

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2010-3333
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2864 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:53 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability

The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption. CISA required action: Apply updates per vendor instructions.

Office CVE-2012-1856

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2012-1856

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2012-1856
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2859 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:49 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Office Memory Corruption Vulnerability

Microsoft Office contains a memory corruption vulnerability that allows remote attackers to execute arbitrary code via a crafted document. CISA required action: Apply updates per vendor instructions.

Office CVE-2015-1642

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2015-1642

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2015-1642
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2844 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:39 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Office Malformed EPS File Vulnerability

Microsoft Office allows remote attackers to execute arbitrary code via a crafted EPS image. CISA required action: Apply updates per vendor instructions.

Office CVE-2015-2545

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2015-2545

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2015-2545
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2840 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:36 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Office Memory Corruption Vulnerability

Microsoft Office contains a memory corruption vulnerability which can allow for remote code execution. CISA required action: Apply updates per vendor instructions.

Office CVE-2016-7193

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2016-7193

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2016-7193
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2833 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:29 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Office Use-After-Free Vulnerability

Microsoft Office contains a use-after-free vulnerability which can allow for remote code execution. CISA required action: Apply updates per vendor instructions.

Office CVE-2017-0261

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2017-0261

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2017-0261
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2827 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:24 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Office Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. CISA required action: Apply updates per vendor instructions.

Office CVE-2017-11826

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2017-11826

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2017-11826
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2824 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:25:22 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Office Uninitialized Memory Use Vulnerability

Microsoft Office allows remote attackers to execute arbitrary code via a crafted Office document. CISA required action: Apply updates per vendor instructions.

Office CVE-2015-1770

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2015-1770

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2015-1770
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2673 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:22:22 GMT
Publisher date: Mon, 28 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability

Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution. CISA required action: Apply updates per vendor instructions.

Office CVE-2021-38646

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2021-38646

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2021-38646
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2658 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:22:12 GMT
Publisher date: Mon, 28 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Office Object Record Corruption Vulnerability

Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object. CISA required action: Apply updates per vendor instructions.

Office CVE-2009-0557

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2009-0557

Office

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2009-0557
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2514 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:19:54 GMT
Publisher date: Wed, 08 Jun 2022 00:00:00 GMT

Read the original announcement

Older events