Office Long Term Servicing Channel vulnerabilities

9 known vulnerabilities in Office Long Term Servicing Channel from Microsoft. 8 are rated high or critical, and 7 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Exploited

  CVE-2026-21514Feb 10, 2026MicrosoftEPSS 1.59%

  Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.

• 7.5 High severity

  Microsoft 365 Apps for Enterprise: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-21260Feb 10, 2026MicrosoftEPSS 1.5%

  Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

• 7.8 High severity

  Microsoft Office Security Feature Bypass Exploited

  CVE-2026-21509Jan 26, 2026MicrosoftEPSS 70.8%

  Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

• 7.3 High severity

  Microsoft Publisher Protection Mechanism Failure Exploited

  CVE-2024-38226Sep 10, 2024MicrosoftEPSS 2.67%

  Microsoft Publisher Security Feature Bypass Vulnerability

• 8.8 High severity

  Microsoft Project Remote Code Execution Exploited

  CVE-2024-38189Aug 13, 2024MicrosoftEPSS 8.19%

  Microsoft Project Remote Code Execution Vulnerability

• 9.8 Critical severity

  Microsoft Outlook Improper Input Validation Exploited

  CVE-2024-21413Feb 13, 2024MicrosoftEPSS 94.7%

  Microsoft Outlook Remote Code Execution Vulnerability

• 7.8 High severity

  3D Viewer: Heap-based Buffer Overflow

  CVE-2024-20677Jan 9, 2024MicrosoftEPSS 3.26%

  A security vulnerability exists in FBX that could lead to remote code execution. To mitigate this vulnerability, the ability to insert FBX files has been disabled in Word, Excel, PowerPoint and Outlook for Windows and Mac. Versions of Office that had this feat

• 6.5 Medium severity

  Microsoft Word Information Disclosure Exploited

  CVE-2023-36761Sep 12, 2023MicrosoftEPSS 19.6%

  Microsoft Word Information Disclosure Vulnerability

• 9.8 Critical severity

  Microsoft Office Outlook Privilege Escalation Exploited

  CVE-2023-23397Mar 14, 2023MicrosoftEPSS 97.2%

  Microsoft Outlook Elevation of Privilege Vulnerability