Excel vulnerabilities

9 known vulnerabilities in Excel from Microsoft. 9 are rated high or critical, and 6 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Microsoft 365 Apps for Enterprise: Access of Resource Using Incompatible Type

  CVE-2026-65807Aug 11, 2026Microsoft

  Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

• 7.0 High severity

  Microsoft 365 Apps for Enterprise: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-44818Jun 9, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

• 9.1 Critical severity

  Excel: Improper Verification of Cryptographic Signature

  CVE-2024-43106Dec 18, 2024Microsoft

  A library injection vulnerability exists in Microsoft Excel 16.83 for macOS. A specially crafted library can leverage Excel's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger thi

• 7.8 High severity

  Microsoft Excel Security Feature Bypass Exploited

  CVE-2021-42292Nov 10, 2021MicrosoftEPSS 43%

  Microsoft Excel Security Feature Bypass Vulnerability

• 8.8 High severity

  Microsoft Excel Remote Code Execution Exploited

  CVE-2019-1297Sep 11, 2019MicrosoftEPSS 21.8%

  A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.

• 7.8 High severity

  Microsoft Office Security Feature Bypass Exploited

  CVE-2016-7262Dec 20, 2016MicrosoftEPSS 58.8%

  Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow user-assisted remote attackers to execute arbitrary commands via a crafted cell that is mishandled upon a click, aka

• 7.8 High severity

  Microsoft Excel Featheader Record Memory Corruption Exploited

  CVE-2009-3129Nov 11, 2009MicrosoftEPSS 84%

  Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint

• 9.3 High severity

  Microsoft Office Remote Code Execution Exploited

  CVE-2009-0238Feb 25, 2009MicrosoftEPSS 42.9%

  Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attacker

• 9.3 High severity

  Microsoft Office Excel Remote Code Execution Exploited

  CVE-2007-0671Feb 3, 2007MicrosoftEPSS 44.1%

  Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as demonstrated by Exploit-MSExcel.h in targeted zero