DeutschShown in its original language — a full translation is planned for a future version.
Microsoft Office: Mehrere Schwachstellen
Ein entfernter, authentisierter Angreifer oder ein lokaler Angreifer kann mehrere Schwachstellen in Microsoft Excel 2016, Microsoft PowerPoint 2016, Microsoft Word 2016, Microsoft Office 2016, Microsoft Outlook 2016, Microsoft Office Online Server, Microsoft SharePoint, Microsoft Office 2019, Microsoft SharePoint Server 2019, Microsoft 365 Apps, Microsoft Teams und Microsoft Office ausnutzen, um Administratorrechte zu erlangen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen und Spoofing-Angriffe durchzuführen.
describes (18)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-49756US | —OT elevated | — | ||
Use of a broken or risky cryptographic algorithm in Office Developer Platform allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2025-49737US | — | — | ||
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Teams allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2025-49731US | — | — | ||
Improper handling of insufficient permissions or privileges in Microsoft Teams allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2025-49711US | — | — | ||
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2025-49706US | —OT critical | KEV | ||
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2025-49705US | — | — | ||
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. | ||||
| CVE-2025-49704US | —OT critical | KEV | ||
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||
| CVE-2025-49703US | — | — | ||
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | ||||
| CVE-2025-49702US | — | — | ||
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2025-49701US | — | — | ||
Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||
| CVE-2025-49700US | — | — | ||
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | ||||
| CVE-2025-49699US | — | — | ||
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2025-49698US | — | — | ||
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | ||||
| CVE-2025-49697US | — | — | ||
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2025-49696US | — | — | ||
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2025-49695US | — | — | ||
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2025-48812US | — | — | ||
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2025-47994US | high8.6 | — | ||
Deserialization of untrusted data in Microsoft Office allows an unauthorized attacker to elevate privileges locally. | ||||
references
External citations — patches, advisories, analysis.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan