Microsoft Office Remote Code Execution Vulnerability

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• microsoft 365 appsall versions
• microsoft 365 copilotall versions
• microsoft microsoft 365all versions
• microsoft office 2016all versions
• microsoft office 2019all versions
• microsoft office 2021all versions
• microsoft office 2024all versions

Versions reported by the vendor

Affected version ranges reported by the assigning authority (microsoft). Independent of NVD's CPE analysis and usually ahead of it.

• Microsoft Microsoft 365 Apps for Enterprise

  • 16.0.1 and later · before https://aka.ms/OfficeSecurityReleasesaffected

• Microsoft Microsoft Office 2016

  • 16.0.0 and later · before 16.0.5556.1005affected

• Microsoft Microsoft Office 2019

  • 19.0.0 and later · before https://aka.ms/OfficeSecurityReleasesaffected

• Microsoft Microsoft Office 365 for Mac

  • 1.0.0 and later · before 16.110.26061317affected

• Microsoft Microsoft Office for Android

  • 16.0.1 and later · before 16.0.20131.20024affected

• Microsoft Microsoft Office LTSC 2021

  • 16.0.1 and later · before https://aka.ms/OfficeSecurityReleasesaffected

• Microsoft Microsoft Office LTSC 2024

  • 16.0.0 and later · before https://aka.ms/OfficeSecurityReleasesaffected

• Microsoft Microsoft Office LTSC for Mac 2021

  • 16.0.1 and later · before 16.110.26061317affected

• Microsoft Microsoft Office LTSC for Mac 2024

  • 16.0.0 and later · before 16.110.26061317affected

Other highest-scoring records for the same primary product.

• CVE-2023-23397Microsoft Outlook Elevation of Privilege VulnerabilityKEV
  98Now
• CVE-2024-21413Microsoft Outlook Remote Code Execution VulnerabilityKEV
  97Now
• CVE-2026-21509Microsoft Office Security Feature Bypass VulnerabilityKEV
  82Now
• CVE-2021-42292Microsoft Excel Security Feature Bypass VulnerabilityKEV
  74This week
• CVE-2023-35311Microsoft Outlook Security Feature Bypass VulnerabilityKEV
  70This week
• CVE-2024-38189Microsoft Project Remote Code Execution VulnerabilityKEV
  67This week

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.