Multiple vulnerabilities in Microsoft Office

Description

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, obtain sensitive information, bypass security restrictions, spoof user interface.

Below is a complete list of vulnerabilities:

1. An elevation of privilege vulnerability in Windows Rich Text Edit can be exploited remotely to gain privileges.
2. A spoofing vulnerability in Microsoft Teams can be exploited remotely to spoof user interface.
3. A remote code execution vulnerability in Microsoft SharePoint Server can be exploited remotely to execute arbitrary code.
4. An elevation of privilege vulnerability in Microsoft Office Click-To-Run can be exploited remotely to gain privileges.
5. An information disclosure vulnerability in Microsoft Word can be exploited remotely to obtain sensitive information.
6. A remote code execution vulnerability in Microsoft Office can be exploited remotely to execute arbitrary code.
7. A remote code execution vulnerability in Microsoft Excel can be exploited remotely to execute arbitrary code.
8. An information disclosure vulnerability in Microsoft Excel can be exploited remotely to obtain sensitive information.
9. A remote code execution vulnerability in Microsoft Word can be exploited remotely to execute arbitrary code.
10. A spoofing vulnerability in Microsoft 365 Copilot for Android can be exploited remotely to spoof user interface.
11. A spoofing vulnerability in Microsoft PowerPoint for Android can be exploited remotely to spoof user interface.
12. A spoofing vulnerability in Microsoft Office can be exploited remotely to spoof user interface.
13. A tampering vulnerability in Microsoft Outlook for iOS can be exploited remotely to spoof user interface.

Original advisories

• CVE-2026-40364

• CVE-2026-40367
• CVE-2026-33112
• CVE-2026-40358
• CVE-2026-40360
• CVE-2026-40368
• CVE-2026-40359
• CVE-2026-40357
• CVE-2026-40366
• CVE-2026-40363
• CVE-2026-35439
• CVE-2026-40421
• CVE-2026-35440
• CVE-2026-40361
• CVE-2026-33110
• CVE-2026-40362
• CVE-2026-40365
• CVE-2026-21530
• CVE-2026-41100
• CVE-2026-32185
• CVE-2026-35436
• CVE-2026-40418
• CVE-2026-40419
• CVE-2026-40420
• CVE-2026-41102
• CVE-2026-42832
• CVE-2026-42893
• CVE-2026-42831
• CVE-2026-42831

Exploitation

Related products

• Microsoft-Office
• Microsoft-Outlook
• Microsoft-Excel
• Microsoft-Word
• Microsoft-SharePoint
• Microsoft-365

CVE list

• CVE-2026-21530
  high
• CVE-2026-32185
  unknown
• CVE-2026-33110
  critical
• CVE-2026-33112
  critical
• CVE-2026-35436
  unknown
• CVE-2026-35439
  critical
• CVE-2026-35440
  high
• CVE-2026-40357
  critical
• CVE-2026-40358
  critical
• CVE-2026-40359
  critical
• CVE-2026-40360
  critical
• CVE-2026-40361
  critical
• CVE-2026-40362
  critical
• CVE-2026-40363
  critical
• CVE-2026-40364
  critical
• CVE-2026-40365
  critical
• CVE-2026-40366
  critical
• CVE-2026-40367
  critical
• CVE-2026-40368
  critical
• CVE-2026-40418
  unknown
• CVE-2026-40419
  unknown
• CVE-2026-40420
  unknown
• CVE-2026-40421
  warning
• CVE-2026-41100
  warning
• CVE-2026-41102
  unknown
• CVE-2026-42831
  unknown
• CVE-2026-42832
  unknown
• CVE-2026-42893
  unknown

KB list

• 5002871
• 5002858
• 5002863
• 5002868
• 5002870
• 5002869
• 5002872
• 5002865
• 5002866
• 5002578

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com