{"schemaVersion":3,"id":"CVE-2025-26642","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.","dates":{"published":"2025-04-08T17:23:45.434Z","modified":"2026-08-10T15:12:41.124Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00797,"percentile":0.55731,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00797},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00797,"percentile":0.55731}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00797,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00797,"percentile":0.55731}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-125","name":"Out-of-bounds Read","description":"The product reads data past the end, or before the beginning, of the intended buffer.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/125.html"},{"id":"CWE-190","name":"Integer Overflow or Wraparound","description":"The product performs a calculation that can\n         produce an integer overflow or wraparound when the logic\n         assumes that the resulting value will always be larger than\n         the original value. This occurs when an integer value is\n         incremented to a value that is too large to store in the\n         associated representation. When this occurs, the value may\n         become a very small or negative number.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/190.html"}],"affected":[{"vendor":"microsoft","product":"365_apps","name":"365 apps","label":"365_apps","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/microsoft/365_apps"},{"vendor":"microsoft","product":"access","name":"access","label":"access","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2016","noFixRecorded":false,"fixedIn":null}],"versionsText":"2016","eol":null,"hubHref":"/vendor/microsoft/access"},{"vendor":"microsoft","product":"excel","name":"excel","label":"excel","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2016","noFixRecorded":false,"fixedIn":null}],"versionsText":"2016","eol":null,"hubHref":"/vendor/microsoft/excel"},{"vendor":"microsoft","product":"microsoft 365 apps for enterprise","name":"Microsoft 365 Apps for Enterprise","label":"microsoft 365 apps for enterprise","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 16.0.1, < https://aka.ms/OfficeSecurityReleases","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 16.0.1, < https://aka.ms/OfficeSecurityReleases","eol":null,"hubHref":"/vendor/microsoft/microsoft_365_apps_for_enterprise"},{"vendor":"microsoft","product":"microsoft access 2016","name":"Microsoft Access 2016","label":"microsoft access 2016","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 16.0.0, < 16.0.5495.1000","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 16.0.0, < 16.0.5495.1000","eol":null,"hubHref":"/vendor/microsoft/microsoft_access_2016"},{"vendor":"microsoft","product":"microsoft access 2016 (32-bit edition)","name":"Microsoft Access 2016 (32-bit edition)","label":"microsoft access 2016 (32-bit edition)","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 16.0.0, < 16.0.5495.1000","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 16.0.0, < 16.0.5495.1000","eol":null,"hubHref":"/vendor/microsoft/microsoft_access_2016_32-bit_edition"},{"vendor":"microsoft","product":"microsoft excel 2016","name":"Microsoft Excel 2016","label":"microsoft excel 2016","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 16.0.0.0, < 16.0.5495.1000","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 16.0.0.0, < 16.0.5495.1000","eol":null,"hubHref":"/vendor/microsoft/microsoft_excel_2016"},{"vendor":"microsoft","product":"microsoft office 2016","name":"Microsoft Office 2016","label":"microsoft office 2016","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 16.0.0, < 16.0.5495.1000","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 16.0.0, < 16.0.5495.1000","eol":null,"hubHref":"/vendor/microsoft/microsoft_office_2016"},{"vendor":"microsoft","product":"microsoft office 2019","name":"Microsoft Office 2019","label":"microsoft office 2019","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 19.0.0, < https://aka.ms/OfficeSecurityReleases","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 19.0.0, < https://aka.ms/OfficeSecurityReleases","eol":null,"hubHref":"/vendor/microsoft/microsoft_office_2019"},{"vendor":"microsoft","product":"microsoft office ltsc 2021","name":"Microsoft Office LTSC 2021","label":"microsoft office ltsc 2021","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 16.0.1, < https://aka.ms/OfficeSecurityReleases","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 16.0.1, < https://aka.ms/OfficeSecurityReleases","eol":null,"hubHref":"/vendor/microsoft/microsoft_office_ltsc_2021"},{"vendor":"microsoft","product":"microsoft office ltsc 2024","name":"Microsoft Office LTSC 2024","label":"microsoft office ltsc 2024","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 16.0.0, < https://aka.ms/OfficeSecurityReleases","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 16.0.0, < https://aka.ms/OfficeSecurityReleases","eol":null,"hubHref":"/vendor/microsoft/microsoft_office_ltsc_2024"},{"vendor":"microsoft","product":"microsoft office ltsc for mac 2021","name":"Microsoft Office LTSC for Mac 2021","label":"microsoft office ltsc for mac 2021","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 16.0.1, < 16.96.25041326","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 16.0.1, < 16.96.25041326","eol":null,"hubHref":"/vendor/microsoft/microsoft_office_ltsc_for_mac_2021"},{"vendor":"microsoft","product":"microsoft office ltsc for mac 2024","name":"Microsoft Office LTSC for Mac 2024","label":"microsoft office ltsc for mac 2024","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 16.0.0, < 16.96.25041326","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 16.0.0, < 16.96.25041326","eol":null,"hubHref":"/vendor/microsoft/microsoft_office_ltsc_for_mac_2024"},{"vendor":"microsoft","product":"microsoft sharepoint server 2019","name":"Microsoft SharePoint Server 2019","label":"microsoft sharepoint server 2019","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 16.0.0, < 16.0.10417.20003","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 16.0.0, < 16.0.10417.20003","eol":null,"hubHref":"/vendor/microsoft/microsoft_sharepoint_server_2019"},{"vendor":"microsoft","product":"office","name":"office","label":"office","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2016","noFixRecorded":false,"fixedIn":null},{"text":"2019","noFixRecorded":false,"fixedIn":null}],"versionsText":"2016 | 2019","eol":{"isEol":true,"eolDate":"2025-10-14T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"2016","label":"2016","eolFrom":"2025-10-14T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"office","label":"Microsoft Office","category":"app"}},"hubHref":"/vendor/microsoft/office"},{"vendor":"microsoft","product":"office_long_term_servicing_channel","name":"office long term servicing channel","label":"office_long_term_servicing_channel","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2021","noFixRecorded":false,"fixedIn":null},{"text":"2024","noFixRecorded":false,"fixedIn":null}],"versionsText":"2021 | 2024","eol":null,"hubHref":"/vendor/microsoft/office_long_term_servicing_channel"},{"vendor":"microsoft","product":"office online server","name":"Office Online Server","label":"office online server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 16.0.0.0, < 16.0.10417.20003","noFixRecorded":false,"fixedIn":null},{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 16.0.0.0, < 16.0.10417.20003 | na","eol":null,"hubHref":"/vendor/microsoft/office_online_server"},{"vendor":"microsoft","product":"sharepoint_server","name":"sharepoint server","label":"sharepoint_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2019","noFixRecorded":false,"fixedIn":null}],"versionsText":"2019","eol":null,"hubHref":"/vendor/microsoft/sharepoint_server"}],"affectedCount":18,"eol":{"hasEol":true,"count":1},"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26642","label":"msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26642","hostname":"msrc.microsoft.com","tags":["Vendor Advisory","Patch"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2025-04-08T17:23:45.434Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-08-10T15:12:41.124Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T04:47:24.917Z","stale":false,"partial":false}}