Search
Find a vulnerability
Search criteria
38010 vulnerabilities by microsoft
CERTFR-2026-AVI-1342
Vulnerability from certfr_avis - Published: 2026-10-19 - Updated: 2026-10-19
De multiples vulnérabilités ont été découvertes dans Microsoft Edge. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un problème de sécurité non spécifié par l'éditeur.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Edge versions ant\u00e9rieures \u00e0 154.0.4258.37",
"product": {
"name": "Edge",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Edge versions 155.0.4283.XX ant\u00e9rieures \u00e0 155.0.4283.60",
"product": {
"name": "Edge",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-106348",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106348"
},
{
"name": "CVE-2026-106208",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106208"
},
{
"name": "CVE-2026-106232",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106232"
},
{
"name": "CVE-2026-106281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106281"
},
{
"name": "CVE-2026-106384",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106384"
},
{
"name": "CVE-2026-106375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106375"
},
{
"name": "CVE-2026-106191",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106191"
},
{
"name": "CVE-2026-106407",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106407"
},
{
"name": "CVE-2026-106268",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106268"
},
{
"name": "CVE-2026-106376",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106376"
},
{
"name": "CVE-2026-106391",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106391"
},
{
"name": "CVE-2026-110167",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110167"
},
{
"name": "CVE-2026-106251",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106251"
},
{
"name": "CVE-2026-110139",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110139"
},
{
"name": "CVE-2026-106189",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106189"
},
{
"name": "CVE-2026-106303",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106303"
},
{
"name": "CVE-2026-106241",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106241"
},
{
"name": "CVE-2026-106297",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106297"
},
{
"name": "CVE-2026-106413",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106413"
},
{
"name": "CVE-2026-106238",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106238"
},
{
"name": "CVE-2026-106273",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106273"
},
{
"name": "CVE-2026-96198",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96198"
},
{
"name": "CVE-2026-106276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106276"
},
{
"name": "CVE-2026-106363",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106363"
},
{
"name": "CVE-2026-106341",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106341"
},
{
"name": "CVE-2026-106418",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106418"
},
{
"name": "CVE-2026-106374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106374"
},
{
"name": "CVE-2026-110145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110145"
},
{
"name": "CVE-2026-106344",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106344"
},
{
"name": "CVE-2026-102322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102322"
},
{
"name": "CVE-2026-106200",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106200"
},
{
"name": "CVE-2026-106257",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106257"
},
{
"name": "CVE-2026-106203",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106203"
},
{
"name": "CVE-2026-106190",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106190"
},
{
"name": "CVE-2026-106199",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106199"
},
{
"name": "CVE-2026-106196",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106196"
},
{
"name": "CVE-2026-106230",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106230"
},
{
"name": "CVE-2026-106300",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106300"
},
{
"name": "CVE-2026-110159",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110159"
},
{
"name": "CVE-2026-110149",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110149"
},
{
"name": "CVE-2026-106332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106332"
},
{
"name": "CVE-2026-106329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106329"
},
{
"name": "CVE-2026-106425",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106425"
},
{
"name": "CVE-2026-106212",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106212"
},
{
"name": "CVE-2026-106216",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106216"
},
{
"name": "CVE-2026-106207",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106207"
},
{
"name": "CVE-2026-106271",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106271"
},
{
"name": "CVE-2026-110168",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110168"
},
{
"name": "CVE-2026-106390",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106390"
},
{
"name": "CVE-2026-106342",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106342"
},
{
"name": "CVE-2026-106197",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106197"
},
{
"name": "CVE-2026-106339",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106339"
},
{
"name": "CVE-2026-106333",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106333"
},
{
"name": "CVE-2026-106193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106193"
},
{
"name": "CVE-2026-106237",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106237"
},
{
"name": "CVE-2026-110137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110137"
},
{
"name": "CVE-2026-106201",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106201"
},
{
"name": "CVE-2026-110150",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110150"
},
{
"name": "CVE-2026-106421",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106421"
},
{
"name": "CVE-2026-106360",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106360"
},
{
"name": "CVE-2026-106343",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106343"
},
{
"name": "CVE-2026-106233",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106233"
},
{
"name": "CVE-2026-106247",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106247"
},
{
"name": "CVE-2026-106351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106351"
},
{
"name": "CVE-2026-85890",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-85890"
},
{
"name": "CVE-2026-106179",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106179"
},
{
"name": "CVE-2026-106306",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106306"
},
{
"name": "CVE-2026-106355",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106355"
},
{
"name": "CVE-2026-106398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106398"
},
{
"name": "CVE-2026-106411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106411"
},
{
"name": "CVE-2026-106382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106382"
},
{
"name": "CVE-2026-106279",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106279"
},
{
"name": "CVE-2026-106242",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106242"
},
{
"name": "CVE-2026-106245",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106245"
},
{
"name": "CVE-2026-110138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110138"
},
{
"name": "CVE-2026-106315",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106315"
},
{
"name": "CVE-2026-106261",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106261"
},
{
"name": "CVE-2026-106312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106312"
},
{
"name": "CVE-2026-106388",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106388"
},
{
"name": "CVE-2026-106356",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106356"
},
{
"name": "CVE-2026-106301",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106301"
},
{
"name": "CVE-2026-106422",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106422"
},
{
"name": "CVE-2026-106389",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106389"
},
{
"name": "CVE-2026-106383",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106383"
},
{
"name": "CVE-2026-110140",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110140"
},
{
"name": "CVE-2026-106234",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106234"
},
{
"name": "CVE-2026-110154",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110154"
},
{
"name": "CVE-2026-106229",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106229"
},
{
"name": "CVE-2026-106396",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106396"
},
{
"name": "CVE-2026-106181",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106181"
},
{
"name": "CVE-2026-106292",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106292"
},
{
"name": "CVE-2026-106187",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106187"
},
{
"name": "CVE-2026-106321",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106321"
},
{
"name": "CVE-2026-106324",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106324"
},
{
"name": "CVE-2026-106236",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106236"
},
{
"name": "CVE-2026-106269",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106269"
},
{
"name": "CVE-2026-106240",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106240"
},
{
"name": "CVE-2026-106357",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106357"
},
{
"name": "CVE-2026-106278",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106278"
},
{
"name": "CVE-2026-110142",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110142"
},
{
"name": "CVE-2026-106265",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106265"
},
{
"name": "CVE-2026-106347",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106347"
},
{
"name": "CVE-2026-106295",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106295"
},
{
"name": "CVE-2026-106345",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106345"
},
{
"name": "CVE-2026-106335",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106335"
},
{
"name": "CVE-2026-106371",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106371"
},
{
"name": "CVE-2026-110143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110143"
},
{
"name": "CVE-2026-110156",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110156"
},
{
"name": "CVE-2026-106381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106381"
},
{
"name": "CVE-2026-106399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106399"
},
{
"name": "CVE-2026-106373",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106373"
},
{
"name": "CVE-2026-106358",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106358"
},
{
"name": "CVE-2026-106334",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106334"
},
{
"name": "CVE-2026-106401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106401"
},
{
"name": "CVE-2026-110144",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110144"
},
{
"name": "CVE-2026-106359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106359"
},
{
"name": "CVE-2026-106214",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106214"
},
{
"name": "CVE-2026-106213",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106213"
},
{
"name": "CVE-2026-106267",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106267"
},
{
"name": "CVE-2026-106338",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106338"
},
{
"name": "CVE-2026-96199",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96199"
},
{
"name": "CVE-2026-110162",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110162"
},
{
"name": "CVE-2026-106426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106426"
},
{
"name": "CVE-2026-106259",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106259"
},
{
"name": "CVE-2026-110146",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110146"
},
{
"name": "CVE-2026-106322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106322"
},
{
"name": "CVE-2026-106202",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106202"
},
{
"name": "CVE-2026-106316",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106316"
},
{
"name": "CVE-2026-106394",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106394"
},
{
"name": "CVE-2026-106304",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106304"
},
{
"name": "CVE-2026-106314",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106314"
},
{
"name": "CVE-2026-106385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106385"
},
{
"name": "CVE-2026-106253",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106253"
},
{
"name": "CVE-2026-106330",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106330"
},
{
"name": "CVE-2026-106239",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106239"
},
{
"name": "CVE-2026-110163",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110163"
},
{
"name": "CVE-2026-106243",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106243"
},
{
"name": "CVE-2026-110164",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110164"
},
{
"name": "CVE-2026-106369",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106369"
},
{
"name": "CVE-2026-110155",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110155"
},
{
"name": "CVE-2026-106194",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106194"
},
{
"name": "CVE-2026-106264",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106264"
},
{
"name": "CVE-2026-106231",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106231"
},
{
"name": "CVE-2026-106352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106352"
},
{
"name": "CVE-2026-106310",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106310"
},
{
"name": "CVE-2026-106410",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106410"
},
{
"name": "CVE-2026-106392",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106392"
},
{
"name": "CVE-2026-106224",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106224"
},
{
"name": "CVE-2026-106248",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106248"
},
{
"name": "CVE-2026-106370",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106370"
},
{
"name": "CVE-2026-110172",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110172"
},
{
"name": "CVE-2026-106308",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106308"
},
{
"name": "CVE-2026-106260",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106260"
},
{
"name": "CVE-2026-110171",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110171"
},
{
"name": "CVE-2026-106294",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106294"
},
{
"name": "CVE-2026-106252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106252"
},
{
"name": "CVE-2026-106349",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106349"
},
{
"name": "CVE-2026-106258",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106258"
},
{
"name": "CVE-2026-106274",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106274"
},
{
"name": "CVE-2026-106327",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106327"
},
{
"name": "CVE-2026-106404",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106404"
},
{
"name": "CVE-2026-106424",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106424"
},
{
"name": "CVE-2026-106415",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106415"
},
{
"name": "CVE-2026-106215",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106215"
},
{
"name": "CVE-2026-106188",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106188"
},
{
"name": "CVE-2026-106198",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106198"
},
{
"name": "CVE-2026-106284",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106284"
},
{
"name": "CVE-2026-106270",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106270"
},
{
"name": "CVE-2026-106250",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106250"
},
{
"name": "CVE-2026-106235",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106235"
},
{
"name": "CVE-2026-106266",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106266"
},
{
"name": "CVE-2026-106226",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106226"
},
{
"name": "CVE-2026-110169",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110169"
},
{
"name": "CVE-2026-106412",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106412"
},
{
"name": "CVE-2026-106365",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106365"
},
{
"name": "CVE-2026-106211",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106211"
},
{
"name": "CVE-2026-106291",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106291"
},
{
"name": "CVE-2026-106286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106286"
},
{
"name": "CVE-2026-106409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106409"
},
{
"name": "CVE-2026-106285",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106285"
},
{
"name": "CVE-2026-106340",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106340"
},
{
"name": "CVE-2026-106423",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106423"
},
{
"name": "CVE-2026-106331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106331"
},
{
"name": "CVE-2026-110151",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110151"
},
{
"name": "CVE-2026-106287",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106287"
},
{
"name": "CVE-2026-106362",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106362"
},
{
"name": "CVE-2026-106256",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106256"
},
{
"name": "CVE-2026-110157",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110157"
},
{
"name": "CVE-2026-106210",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106210"
},
{
"name": "CVE-2026-85897",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-85897"
},
{
"name": "CVE-2026-106222",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106222"
},
{
"name": "CVE-2026-110147",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110147"
},
{
"name": "CVE-2026-106263",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106263"
},
{
"name": "CVE-2026-110166",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110166"
},
{
"name": "CVE-2026-106293",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106293"
},
{
"name": "CVE-2026-106393",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106393"
},
{
"name": "CVE-2026-106379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106379"
},
{
"name": "CVE-2026-106180",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106180"
},
{
"name": "CVE-2026-106205",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106205"
},
{
"name": "CVE-2026-106280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106280"
},
{
"name": "CVE-2026-106416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106416"
},
{
"name": "CVE-2026-106255",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106255"
},
{
"name": "CVE-2026-106195",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106195"
},
{
"name": "CVE-2026-106275",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106275"
},
{
"name": "CVE-2026-106350",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106350"
},
{
"name": "CVE-2026-106386",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106386"
},
{
"name": "CVE-2026-106377",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106377"
},
{
"name": "CVE-2026-106204",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106204"
},
{
"name": "CVE-2026-106311",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106311"
},
{
"name": "CVE-2026-106227",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106227"
},
{
"name": "CVE-2026-106289",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106289"
},
{
"name": "CVE-2026-106402",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106402"
},
{
"name": "CVE-2026-106228",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106228"
},
{
"name": "CVE-2026-106262",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106262"
},
{
"name": "CVE-2026-110141",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110141"
},
{
"name": "CVE-2026-106318",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106318"
},
{
"name": "CVE-2026-106220",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106220"
},
{
"name": "CVE-2026-106328",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106328"
},
{
"name": "CVE-2026-106244",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106244"
},
{
"name": "CVE-2026-106217",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106217"
},
{
"name": "CVE-2026-110170",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110170"
},
{
"name": "CVE-2026-110153",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110153"
},
{
"name": "CVE-2026-106186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106186"
},
{
"name": "CVE-2026-106225",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106225"
},
{
"name": "CVE-2026-106182",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106182"
},
{
"name": "CVE-2026-106183",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106183"
},
{
"name": "CVE-2026-106185",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106185"
},
{
"name": "CVE-2026-106288",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106288"
},
{
"name": "CVE-2026-106184",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106184"
},
{
"name": "CVE-2026-106309",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106309"
},
{
"name": "CVE-2026-106283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106283"
},
{
"name": "CVE-2026-106272",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106272"
},
{
"name": "CVE-2026-106249",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106249"
},
{
"name": "CVE-2026-110165",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110165"
},
{
"name": "CVE-2026-106346",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106346"
},
{
"name": "CVE-2026-110136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110136"
},
{
"name": "CVE-2026-106417",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106417"
},
{
"name": "CVE-2026-106307",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106307"
},
{
"name": "CVE-2026-106246",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106246"
},
{
"name": "CVE-2026-106364",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106364"
},
{
"name": "CVE-2026-110161",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110161"
},
{
"name": "CVE-2026-106299",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106299"
},
{
"name": "CVE-2026-106336",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106336"
},
{
"name": "CVE-2026-106403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106403"
},
{
"name": "CVE-2026-110148",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110148"
},
{
"name": "CVE-2026-110160",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110160"
},
{
"name": "CVE-2026-106302",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106302"
},
{
"name": "CVE-2026-106325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106325"
},
{
"name": "CVE-2026-106277",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106277"
},
{
"name": "CVE-2026-110152",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110152"
},
{
"name": "CVE-2026-106420",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106420"
},
{
"name": "CVE-2026-106378",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106378"
},
{
"name": "CVE-2026-106354",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106354"
}
],
"initial_release_date": "2026-10-19T00:00:00",
"last_revision_date": "2026-10-19T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1342",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-19T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Microsoft Edge. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Edge",
"vendor_advisories": [
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106398",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106398"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110143",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110143"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110162",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110162"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106396",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106396"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106253",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106253"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106415",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106415"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106274",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106274"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106355",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106355"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106362",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106362"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106237",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106237"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106354",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106354"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106227",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106227"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106301",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106301"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106265",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106265"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106182",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106182"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106347",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106347"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106309",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106309"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110149",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110149"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110165",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110165"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106269",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106269"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110153",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110153"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106185",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106185"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106330",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106330"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106409",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106409"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106390",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106390"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106277",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106277"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106334",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106334"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106179",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106179"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106231",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106231"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110171",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110171"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106364",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106364"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106306",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106306"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106238",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106238"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106294",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106294"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106378",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106378"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106198",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106198"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106195",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106195"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106381",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106381"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106423",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106423"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106203",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106203"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110156",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110156"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106425",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106425"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106374",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106374"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106310",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106310"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106255",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106255"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106204",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106204"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106356",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106356"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106278",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106278"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106200",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106200"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106416",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106416"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106244",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106244"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106228",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106228"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106260",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106260"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106349",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106349"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106252",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106252"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106312",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106312"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106208",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106208"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106348",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106348"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106291",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106291"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106373",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106373"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106273",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106273"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110152",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110152"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106389",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106389"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110139",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110139"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106236",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106236"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106418",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106418"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106315",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106315"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106411",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106411"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106307",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106307"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110167",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110167"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106225",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106225"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106302",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106302"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106276",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106276"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106186",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106186"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106401",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106401"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106285",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106285"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106189",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106189"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106382",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106382"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106417",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106417"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106420",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106420"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106251",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106251"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106205",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106205"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110137",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110137"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106331",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106331"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106360",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106360"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106304",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106304"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-102322",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102322"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106295",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106295"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110168",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110168"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106386",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106386"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106392",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106392"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110172",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110172"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106292",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106292"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106235",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106235"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106229",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106229"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106328",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106328"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106421",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106421"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110160",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110160"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110161",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110161"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106424",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106424"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106222",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106222"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106311",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106311"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106393",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106393"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106343",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106343"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106275",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106275"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106239",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106239"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106391",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106391"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106344",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106344"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106202",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106202"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106233",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106233"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106201",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106201"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106321",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106321"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106287",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106287"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106332",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106332"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106385",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106385"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106234",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106234"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106247",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106247"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106214",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106214"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106318",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106318"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106422",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106422"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106384",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106384"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106340",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106340"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106342",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106342"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106213",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106213"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106246",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106246"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110148",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110148"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110145",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110145"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106279",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106279"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106339",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106339"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110170",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110170"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106402",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106402"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106259",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106259"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110163",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110163"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106242",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106242"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106266",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106266"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106369",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106369"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106336",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106336"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106183",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106183"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106281",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106281"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106308",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106308"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106243",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106243"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106207",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106207"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110151",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110151"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106379",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106379"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106303",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106303"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106363",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106363"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106345",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106345"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106371",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106371"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106212",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106212"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106299",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106299"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106283",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106283"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106216",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106216"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106365",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106365"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110146",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110146"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106410",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106410"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106188",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106188"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106210",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106210"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110166",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110166"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106327",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106327"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-85890",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85890"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106197",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106197"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106262",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106262"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106426",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106426"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110169",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110169"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106267",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106267"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106314",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106314"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106376",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106376"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110157",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110157"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106316",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106316"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106272",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106272"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106352",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106352"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106194",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106194"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106199",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106199"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106256",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106256"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106193",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106193"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110159",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110159"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106217",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106217"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106403",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106403"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110140",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110140"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110150",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110150"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106300",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106300"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110138",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110138"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106350",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106350"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106230",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106230"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-96199",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96199"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106358",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106358"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106263",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106263"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106297",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106297"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106187",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106187"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106289",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106289"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106249",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106249"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106341",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106341"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106412",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106412"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106191",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106191"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106338",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106338"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106261",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106261"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106196",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106196"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106180",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106180"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106375",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106375"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-85897",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85897"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106240",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106240"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106284",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106284"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106293",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106293"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106184",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106184"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110142",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110142"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106258",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106258"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-96198",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96198"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106333",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106333"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106257",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106257"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106377",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106377"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106268",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106268"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106388",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106388"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106220",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106220"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106226",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106226"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110144",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110144"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106404",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106404"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106288",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106288"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106324",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106324"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106413",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106413"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106335",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106335"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106211",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106211"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106215",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106215"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106250",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106250"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106270",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106270"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106399",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106399"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106181",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106181"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106264",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106264"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106241",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106241"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106280",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106280"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106322",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106322"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106407",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106407"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106359",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106359"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106346",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106346"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106286",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106286"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110154",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110154"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106232",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106232"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106224",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106224"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106245",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106245"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106394",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106394"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106271",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106271"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106190",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106190"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106370",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106370"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110155",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110155"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106325",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106325"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110141",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110141"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106329",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106329"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106383",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106383"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110147",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110147"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106357",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106357"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106248",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106248"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110136",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110136"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-106351",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-106351"
},
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-110164",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110164"
}
]
}
CERTFR-2026-AVI-1332
Vulnerability from certfr_avis - Published: 2026-10-16 - Updated: 2026-10-16
De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | System.Formats.Cbor versions antérieures à 10.0.13 | ||
| Microsoft | N/A | Microsoft Visual Studio 2026 version 18.10 antérieures à 18.10.4 | ||
| Microsoft | N/A | Microsoft Identity Client pour NodeJS versions antérieures à 7.1.0 | ||
| Microsoft | N/A | System.Formats.Cbor versions antérieures à 8.0.1 | ||
| Microsoft | N/A | microsoft-identity-web versions antérieures à 3.16.0 | ||
| Microsoft | N/A | System.Formats.Cbor versions antérieures à 9.0.21 | ||
| Microsoft | SharePoint Server Subscription Edition | Microsoft SharePoint Server Subscription Edition versions antérieures à 16.0.20326.20190 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.14 antérieures à 17.14.42 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "System.Formats.Cbor versions ant\u00e9rieures \u00e0 10.0.13",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2026 version 18.10 ant\u00e9rieures \u00e0 18.10.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Identity Client pour NodeJS versions ant\u00e9rieures \u00e0 7.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "System.Formats.Cbor versions ant\u00e9rieures \u00e0 8.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "microsoft-identity-web versions ant\u00e9rieures \u00e0 3.16.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "System.Formats.Cbor versions ant\u00e9rieures \u00e0 9.0.21",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SharePoint Server Subscription Edition versions ant\u00e9rieures \u00e0 16.0.20326.20190",
"product": {
"name": "SharePoint Server Subscription Edition",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.14 ant\u00e9rieures \u00e0 17.14.42",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-109461",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109461"
},
{
"name": "CVE-2026-80092",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80092"
},
{
"name": "CVE-2026-108452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108452"
},
{
"name": "CVE-2026-109468",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109468"
}
],
"initial_release_date": "2026-10-16T00:00:00",
"last_revision_date": "2026-10-16T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1332",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-16T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Microsoft. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-109461",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-109468",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109468"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-108452",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108452"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-80092",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80092"
}
]
}
CERTFR-2026-AVI-1331
Vulnerability from certfr_avis - Published: 2026-10-16 - Updated: 2026-10-16
De multiples vulnérabilités ont été découvertes dans Microsoft Office. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | Office | Microsoft Office LTSC 2024 pour éditions 32 bits versions antérieures à 16.0.17932.21056 | ||
| Microsoft | Office | Office Online Server versions antérieures à 16.0.10417.20228 | ||
| Microsoft | Office | Microsoft Office LTSC pour Mac 2021 versions antérieures à 16.114.26101123 | ||
| Microsoft | Office | Microsoft Office LTSC 2024 pour éditions 64 bits versions antérieures à 16.0.17932.21056 | ||
| Microsoft | Office | Microsoft 365 Apps pour Enterprise pour systèmes 64 bits | ||
| Microsoft | Office | Microsoft Office LTSC 2021 pour éditions 32 bits versions antérieures à 16.0.14334.20974 | ||
| Microsoft | Office | Microsoft Office 365 pour Mac versions antérieures à 16.114.26101123 | ||
| Microsoft | Office | Microsoft Office LTSC 2021 pour éditions 64 bits versions antérieures à 16.0.14334.20974 | ||
| Microsoft | Office | Microsoft 365 Apps pour Enterprise pour systèmes 32 bits | ||
| Microsoft | Office | Microsoft Office LTSC pour Mac 2024 versions antérieures à 16.114.26101123 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Office LTSC 2024 pour \u00e9ditions 32 bits versions ant\u00e9rieures \u00e0 16.0.17932.21056",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Office Online Server versions ant\u00e9rieures \u00e0 16.0.10417.20228",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Office LTSC pour Mac 2021 versions ant\u00e9rieures \u00e0 16.114.26101123",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Office LTSC 2024 pour \u00e9ditions 64 bits versions ant\u00e9rieures \u00e0 16.0.17932.21056",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 64 bits",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Office LTSC 2021 pour \u00e9ditions 32 bits versions ant\u00e9rieures \u00e0 16.0.14334.20974",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Office 365 pour Mac versions ant\u00e9rieures \u00e0 16.114.26101123",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Office LTSC 2021 pour \u00e9ditions 64 bits versions ant\u00e9rieures \u00e0 16.0.14334.20974",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Office LTSC pour Mac 2024 versions ant\u00e9rieures \u00e0 16.114.26101123",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-108446",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108446"
},
{
"name": "CVE-2026-108429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108429"
},
{
"name": "CVE-2026-108434",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108434"
},
{
"name": "CVE-2026-108437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108437"
},
{
"name": "CVE-2026-108450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108450"
},
{
"name": "CVE-2026-108445",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108445"
},
{
"name": "CVE-2026-108440",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108440"
},
{
"name": "CVE-2026-108427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108427"
},
{
"name": "CVE-2026-108432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108432"
},
{
"name": "CVE-2026-108447",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108447"
},
{
"name": "CVE-2026-108454",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108454"
},
{
"name": "CVE-2026-108430",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108430"
},
{
"name": "CVE-2026-108444",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108444"
},
{
"name": "CVE-2026-108449",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108449"
},
{
"name": "CVE-2026-108426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108426"
},
{
"name": "CVE-2026-108448",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108448"
},
{
"name": "CVE-2026-108428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108428"
},
{
"name": "CVE-2026-108441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108441"
},
{
"name": "CVE-2026-108443",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108443"
},
{
"name": "CVE-2026-108436",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108436"
},
{
"name": "CVE-2026-108438",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108438"
},
{
"name": "CVE-2026-108442",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108442"
},
{
"name": "CVE-2026-108433",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108433"
},
{
"name": "CVE-2026-108439",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108439"
},
{
"name": "CVE-2026-108431",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108431"
},
{
"name": "CVE-2026-108453",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108453"
},
{
"name": "CVE-2026-108455",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108455"
},
{
"name": "CVE-2026-108451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108451"
},
{
"name": "CVE-2026-108435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-108435"
}
],
"initial_release_date": "2026-10-16T00:00:00",
"last_revision_date": "2026-10-16T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1331",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-16T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Microsoft Office. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Office",
"vendor_advisories": [
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108442",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108442"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108444",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108444"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108448",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108448"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108454",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108454"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108429",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108429"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108432",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108432"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108453",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108453"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108434",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108434"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108438",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108438"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108439",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108439"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108445",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108445"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108455",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108455"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108450",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108450"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108440",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108440"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108437",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108437"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108443",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108443"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108427",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108427"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108451",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108451"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108426",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108426"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108436",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108436"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108428",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108428"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108449",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108449"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108431",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108431"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108446",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108446"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108435",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108435"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108433",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108433"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108441",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108441"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108430",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108430"
},
{
"published_at": "2026-10-15",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Office CVE-2026-108447",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108447"
}
]
}
CVE-2026-80092 (GCVE-0-2026-80092)
Vulnerability from nvd – Published: 2026-10-16 17:12 – Updated: 2026-10-20 18:45
VLAI
EPSS
VEX
Title
Microsoft Identity Web Elevation of Privilege Vulnerability
Summary
Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-17 03:55 UTC
CWE
- CWE-302 - Authentication Bypass by Assumed-Immutable Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | microsoft-identity-web |
Affected:
>=4.16.0 <4.16.1 , < 4.16.1
(custom)
|
|
| Microsoft | microsoft-identity-web |
Affected:
<3.16.0 , < 3.16.0
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80092",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-17T03:55:57.786472Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T13:05:49.901Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "microsoft-identity-web",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.16.1",
"status": "affected",
"version": "\u003e=4.16.0 \u003c4.16.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"v3"
],
"product": "microsoft-identity-web",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "3.16.0",
"status": "affected",
"version": "\u003c3.16.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:microsoft-identity-web:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.16.1",
"versionStartIncluding": "\u003e=4.16.0 \u003c4.16.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:microsoft-identity-web:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.16.0",
"versionStartIncluding": "\u003c3.16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-302",
"description": "CWE-302: Authentication Bypass by Assumed-Immutable Data",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:45:28.387Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Identity Web Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80092"
}
],
"title": "Microsoft Identity Web Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-80092",
"datePublished": "2026-10-16T17:12:01.521Z",
"dateReserved": "2026-08-25T18:37:59.829Z",
"dateUpdated": "2026-10-20T18:45:28.387Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109461 (GCVE-0-2026-109461)
Vulnerability from nvd – Published: 2026-10-16 17:11 – Updated: 2026-10-20 18:45
VLAI
EPSS
VEX
Title
Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability
Summary
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 17:32 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Identity Client for NodeJS |
Affected:
5.0.0 , < 7.1.0
(custom)
cpe:2.3:a:microsoft:microsoft_identity_client_for_nodejs:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109461",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T17:32:18.910994Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:22:48.440Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"Windows 10 Version 22H2 for x64-based Systems"
],
"product": "Microsoft Identity Client for NodeJS",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "7.1.0",
"status": "affected",
"version": "5.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:microsoft_identity_client_for_nodejs:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.0",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:45:26.215Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461"
}
],
"title": "Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-109461",
"datePublished": "2026-10-16T17:11:24.532Z",
"dateReserved": "2026-10-12T17:01:11.370Z",
"dateUpdated": "2026-10-20T18:45:26.215Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109468 (GCVE-0-2026-109468)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:33
VLAI
EPSS
VEX
Title
ASP.NET Core Denial of Service Vulnerability
Summary
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 01:02 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Visual Studio 2022 version 17.14 |
Affected:
17.14.0 , < 17.14.42
(custom)
|
|
| Microsoft | Microsoft Visual Studio 2026 version 18.10 |
Affected:
18.10.0 , < 18.10.4
(custom)
|
|
| Microsoft | System.Formats.Cbor |
Affected:
10.0.0 , < 10.0.13
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109468",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T01:02:29.736327Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T01:03:46.052Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Visual Studio 2022 version 17.14",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "17.14.42",
"status": "affected",
"version": "17.14.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Visual Studio 2026 version 18.10",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "18.10.4",
"status": "affected",
"version": "18.10.0",
"versionType": "custom"
}
]
},
{
"platforms": [
".NET 10.0 installed on Linux",
".NET 10.0 installed on Mac OS",
".NET 10.0 installed on Windows",
".NET 8.0 installed on Linux",
".NET 8.0 installed on Mac OS",
".NET 8.0 installed on Windows",
".NET 9.0 installed on Linux",
".NET 9.0 installed on Mac OS",
".NET 9.0 installed on Windows"
],
"product": "System.Formats.Cbor",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.13",
"status": "affected",
"version": "10.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:system.formats.cbor:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.13",
"versionStartIncluding": "10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.10:*:*:*:*:*:*:*:*",
"versionEndExcluding": "18.10.4",
"versionStartIncluding": "18.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.14.42",
"versionStartIncluding": "17.14.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:33:07.859Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "ASP.NET Core Denial of Service Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109468"
}
],
"title": "ASP.NET Core Denial of Service Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-109468",
"datePublished": "2026-10-15T20:57:33.441Z",
"dateReserved": "2026-10-12T17:01:11.370Z",
"dateUpdated": "2026-10-20T18:33:07.859Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108455 (GCVE-0-2026-108455)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:33
VLAI
EPSS
VEX
Title
Microsoft Office PowerPoint Information Disclosure Vulnerability
Summary
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 01:02 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Affected:
16.0.1 , < https://aka.ms/OfficeSecurityReleases
(custom)
|
|
| Microsoft | Microsoft Office 365 for Mac |
Affected:
1.0.0 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2021 |
Affected:
16.0.1 , < 16.0.14334.20974
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2024 |
Affected:
16.0.0 , < 16.0.17932.21056
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2021 |
Affected:
16.0.1 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2024 |
Affected:
16.0.0 , < 16.114.26101123
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108455",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T01:02:25.735161Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T01:03:46.177Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office 365 for Mac",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.14334.20974",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.17932.21056",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.14334.20974",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.17932.21056",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:33:03.032Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office PowerPoint Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108455"
}
],
"title": "Microsoft Office PowerPoint Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108455",
"datePublished": "2026-10-15T20:57:31.802Z",
"dateReserved": "2026-10-09T21:52:56.479Z",
"dateUpdated": "2026-10-20T18:33:03.032Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108454 (GCVE-0-2026-108454)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:33
VLAI
EPSS
VEX
Title
Microsoft Office PowerPoint Information Disclosure Vulnerability
Summary
Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 01:02 UTC
CWE
- CWE-126 - Buffer Over-read
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Affected:
16.0.1 , < https://aka.ms/OfficeSecurityReleases
(custom)
|
|
| Microsoft | Microsoft Office 365 for Mac |
Affected:
1.0.0 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2021 |
Affected:
16.0.1 , < 16.0.14334.20974
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2024 |
Affected:
16.0.0 , < 16.0.17932.21056
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2021 |
Affected:
16.0.1 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2024 |
Affected:
16.0.0 , < 16.114.26101123
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108454",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T01:02:21.531105Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T01:03:46.300Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office 365 for Mac",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.14334.20974",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.17932.21056",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.14334.20974",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.17932.21056",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-126",
"description": "CWE-126: Buffer Over-read",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:33:02.509Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office PowerPoint Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108454"
}
],
"title": "Microsoft Office PowerPoint Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108454",
"datePublished": "2026-10-15T20:57:31.358Z",
"dateReserved": "2026-10-09T21:52:56.479Z",
"dateUpdated": "2026-10-20T18:33:02.509Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108453 (GCVE-0-2026-108453)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:33
VLAI
EPSS
VEX
Title
Microsoft Office PowerPoint Information Disclosure Vulnerability
Summary
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 01:02 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Affected:
16.0.1 , < https://aka.ms/OfficeSecurityReleases
(custom)
|
|
| Microsoft | Microsoft Office 365 for Mac |
Affected:
1.0.0 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2021 |
Affected:
16.0.1 , < 16.0.14334.20974
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2024 |
Affected:
16.0.0 , < 16.0.17932.21056
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2021 |
Affected:
16.0.1 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2024 |
Affected:
16.0.0 , < 16.114.26101123
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108453",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T01:02:15.578601Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T01:03:46.425Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office 365 for Mac",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.14334.20974",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.17932.21056",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.14334.20974",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.17932.21056",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:33:02.066Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office PowerPoint Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108453"
}
],
"title": "Microsoft Office PowerPoint Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108453",
"datePublished": "2026-10-15T20:57:30.741Z",
"dateReserved": "2026-10-09T21:52:56.479Z",
"dateUpdated": "2026-10-20T18:33:02.066Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108452 (GCVE-0-2026-108452)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:33
VLAI
EPSS
VEX
Title
Microsoft Office SharePoint Remote Code Execution Vulnerability
Summary
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 00:00 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft SharePoint Server Subscription Edition |
Affected:
16.0.0 , < 16.0.20326.20190
(custom)
cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:* |
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108452",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T03:55:40.985Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SharePoint Server Subscription Edition",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.20326.20190",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*",
"versionEndExcluding": "16.0.20326.20190",
"versionStartIncluding": "16.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Improper limitation of a pathname to a restricted directory (\u0027path traversal\u0027) in Microsoft Office SharePoint allows an authorized attacker to execute code over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:33:01.559Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office SharePoint Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108452"
}
],
"title": "Microsoft Office SharePoint Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108452",
"datePublished": "2026-10-15T20:57:30.172Z",
"dateReserved": "2026-10-09T21:52:56.479Z",
"dateUpdated": "2026-10-20T18:33:01.559Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108451 (GCVE-0-2026-108451)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:33
VLAI
EPSS
VEX
Title
Microsoft Office Word Remote Code Execution Vulnerability
Summary
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 00:00 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Affected:
16.0.1 , < https://aka.ms/OfficeSecurityReleases
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2021 |
Affected:
16.0.1 , < 16.0.14334.20974
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2024 |
Affected:
16.0.0 , < 16.0.17932.21056
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108451",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T03:55:40.208Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.14334.20974",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.17932.21056",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.14334.20974",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.17932.21056",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-197",
"description": "CWE-197: Numeric Truncation Error",
"lang": "en-US",
"type": "CWE"
},
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:33:00.979Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office Word Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108451"
}
],
"title": "Microsoft Office Word Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108451",
"datePublished": "2026-10-15T20:57:29.634Z",
"dateReserved": "2026-10-09T21:52:56.479Z",
"dateUpdated": "2026-10-20T18:33:00.979Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108450 (GCVE-0-2026-108450)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:33
VLAI
EPSS
VEX
Title
Microsoft Office Word Remote Code Execution Vulnerability
Summary
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 00:00 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Affected:
16.0.1 , < https://aka.ms/OfficeSecurityReleases
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2021 |
Affected:
16.0.1 , < 16.0.14334.20974
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2024 |
Affected:
16.0.0 , < 16.0.17932.21056
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108450",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T03:55:30.334Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.14334.20974",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.17932.21056",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.14334.20974",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.17932.21056",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en-US",
"type": "CWE"
},
{
"cweId": "CWE-197",
"description": "CWE-197: Numeric Truncation Error",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:33:00.363Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office Word Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108450"
}
],
"title": "Microsoft Office Word Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108450",
"datePublished": "2026-10-15T20:57:29.062Z",
"dateReserved": "2026-10-09T21:52:56.479Z",
"dateUpdated": "2026-10-20T18:33:00.363Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108449 (GCVE-0-2026-108449)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:32
VLAI
EPSS
VEX
Title
Microsoft Office Word Remote Code Execution Vulnerability
Summary
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 00:00 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Affected:
16.0.1 , < https://aka.ms/OfficeSecurityReleases
(custom)
|
|
| Microsoft | Microsoft Office 365 for Mac |
Affected:
1.0.0 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2021 |
Affected:
16.0.1 , < 16.0.14334.20974
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2024 |
Affected:
16.0.0 , < 16.0.17932.21056
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2021 |
Affected:
16.0.1 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2024 |
Affected:
16.0.0 , < 16.114.26101123
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108449",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T03:55:29.529Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office 365 for Mac",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.14334.20974",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.17932.21056",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.14334.20974",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.17932.21056",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:32:59.770Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office Word Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108449"
}
],
"title": "Microsoft Office Word Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108449",
"datePublished": "2026-10-15T20:57:28.481Z",
"dateReserved": "2026-10-09T21:52:56.479Z",
"dateUpdated": "2026-10-20T18:32:59.770Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108448 (GCVE-0-2026-108448)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:32
VLAI
EPSS
VEX
Title
Microsoft Office Outlook Remote Code Execution Vulnerability
Summary
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 00:00 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Affected:
16.0.1 , < https://aka.ms/OfficeSecurityReleases
(custom)
|
|
| Microsoft | Microsoft Office 365 for Mac |
Affected:
1.0.0 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2021 |
Affected:
16.0.1 , < 16.0.14334.20974
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2024 |
Affected:
16.0.0 , < 16.0.17932.21056
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2021 |
Affected:
16.0.1 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2024 |
Affected:
16.0.0 , < 16.114.26101123
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108448",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T03:55:31.855Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office 365 for Mac",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.14334.20974",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.17932.21056",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.14334.20974",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.17932.21056",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:32:59.165Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office Outlook Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108448"
}
],
"title": "Microsoft Office Outlook Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108448",
"datePublished": "2026-10-15T20:57:27.955Z",
"dateReserved": "2026-10-09T21:52:56.479Z",
"dateUpdated": "2026-10-20T18:32:59.165Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108447 (GCVE-0-2026-108447)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:32
VLAI
EPSS
VEX
Title
Microsoft Office Word Remote Code Execution Vulnerability
Summary
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 00:00 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Affected:
16.0.1 , < https://aka.ms/OfficeSecurityReleases
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2021 |
Affected:
16.0.1 , < 16.0.14334.20974
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2024 |
Affected:
16.0.0 , < 16.0.17932.21056
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108447",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T03:55:28.731Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.14334.20974",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.17932.21056",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.14334.20974",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.17932.21056",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:32:58.647Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office Word Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108447"
}
],
"title": "Microsoft Office Word Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108447",
"datePublished": "2026-10-15T20:57:27.523Z",
"dateReserved": "2026-10-09T21:52:56.479Z",
"dateUpdated": "2026-10-20T18:32:58.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108446 (GCVE-0-2026-108446)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:32
VLAI
EPSS
VEX
Title
Microsoft Office Excel Remote Code Execution Vulnerability
Summary
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 00:00 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Affected:
16.0.1 , < https://aka.ms/OfficeSecurityReleases
(custom)
|
|
| Microsoft | Microsoft Office 365 for Mac |
Affected:
1.0.0 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2021 |
Affected:
16.0.1 , < 16.0.14334.20974
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2024 |
Affected:
16.0.0 , < 16.0.17932.21056
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2021 |
Affected:
16.0.1 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2024 |
Affected:
16.0.0 , < 16.114.26101123
(custom)
|
|
| Microsoft | Office Online Server |
Affected:
16.0.0.0 , < 16.0.10417.20228
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108446",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T03:55:39.328Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office 365 for Mac",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.14334.20974",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.17932.21056",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"product": "Office Online Server",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.10417.20228",
"status": "affected",
"version": "16.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.14334.20974",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.17932.21056",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:ltsc:*:*:*",
"versionEndExcluding": "16.0.10417.20228",
"versionStartIncluding": "16.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:32:58.185Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office Excel Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108446"
}
],
"title": "Microsoft Office Excel Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108446",
"datePublished": "2026-10-15T20:57:27.027Z",
"dateReserved": "2026-10-09T21:52:56.479Z",
"dateUpdated": "2026-10-20T18:32:58.185Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108445 (GCVE-0-2026-108445)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:32
VLAI
EPSS
VEX
Title
Microsoft Office Word Remote Code Execution Vulnerability
Summary
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 00:00 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Affected:
16.0.1 , < https://aka.ms/OfficeSecurityReleases
(custom)
|
|
| Microsoft | Microsoft Office 365 for Mac |
Affected:
1.0.0 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2021 |
Affected:
16.0.1 , < 16.0.14334.20974
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2024 |
Affected:
16.0.0 , < 16.0.17932.21056
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2021 |
Affected:
16.0.1 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2024 |
Affected:
16.0.0 , < 16.114.26101123
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108445",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T03:55:33.453Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office 365 for Mac",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.14334.20974",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.17932.21056",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.14334.20974",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.17932.21056",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:32:57.656Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office Word Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108445"
}
],
"title": "Microsoft Office Word Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108445",
"datePublished": "2026-10-15T20:57:26.447Z",
"dateReserved": "2026-10-09T21:52:56.479Z",
"dateUpdated": "2026-10-20T18:32:57.656Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108444 (GCVE-0-2026-108444)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:32
VLAI
EPSS
VEX
Title
Microsoft Office Remote Code Execution Vulnerability
Summary
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 00:00 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Affected:
16.0.1 , < https://aka.ms/OfficeSecurityReleases
(custom)
|
|
| Microsoft | Microsoft Office 365 for Mac |
Affected:
1.0.0 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2021 |
Affected:
16.0.1 , < 16.0.14334.20974
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2024 |
Affected:
16.0.0 , < 16.0.17932.21056
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2021 |
Affected:
16.0.1 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2024 |
Affected:
16.0.0 , < 16.114.26101123
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108444",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T03:55:37.373Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office 365 for Mac",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.14334.20974",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.17932.21056",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.14334.20974",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.17932.21056",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:32:57.206Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108444"
}
],
"title": "Microsoft Office Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108444",
"datePublished": "2026-10-15T20:57:25.862Z",
"dateReserved": "2026-10-09T21:52:56.479Z",
"dateUpdated": "2026-10-20T18:32:57.206Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108443 (GCVE-0-2026-108443)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:32
VLAI
EPSS
VEX
Title
Microsoft Office Word Remote Code Execution Vulnerability
Summary
Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 00:00 UTC
CWE
- CWE-193 - Off-by-one Error
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Affected:
16.0.1 , < https://aka.ms/OfficeSecurityReleases
(custom)
|
|
| Microsoft | Microsoft Office 365 for Mac |
Affected:
1.0.0 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2021 |
Affected:
16.0.1 , < 16.0.14334.20974
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2024 |
Affected:
16.0.0 , < 16.0.17932.21056
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2021 |
Affected:
16.0.1 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2024 |
Affected:
16.0.0 , < 16.114.26101123
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108443",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T03:55:38.130Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office 365 for Mac",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.14334.20974",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.17932.21056",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.14334.20974",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.17932.21056",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-193",
"description": "CWE-193: Off-by-one Error",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:32:56.668Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office Word Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108443"
}
],
"title": "Microsoft Office Word Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108443",
"datePublished": "2026-10-15T20:57:25.400Z",
"dateReserved": "2026-10-09T21:52:56.478Z",
"dateUpdated": "2026-10-20T18:32:56.668Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108442 (GCVE-0-2026-108442)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:32
VLAI
EPSS
VEX
Title
Microsoft Office Word Remote Code Execution Vulnerability
Summary
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 00:00 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Affected:
16.0.1 , < https://aka.ms/OfficeSecurityReleases
(custom)
|
|
| Microsoft | Microsoft Office 365 for Mac |
Affected:
1.0.0 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2021 |
Affected:
16.0.1 , < 16.0.14334.20974
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2024 |
Affected:
16.0.0 , < 16.0.17932.21056
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2021 |
Affected:
16.0.1 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2024 |
Affected:
16.0.0 , < 16.114.26101123
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108442",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T03:55:35.044Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office 365 for Mac",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.14334.20974",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.17932.21056",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.14334.20974",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.17932.21056",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:32:56.081Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office Word Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108442"
}
],
"title": "Microsoft Office Word Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108442",
"datePublished": "2026-10-15T20:57:24.871Z",
"dateReserved": "2026-10-09T21:52:56.478Z",
"dateUpdated": "2026-10-20T18:32:56.081Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108441 (GCVE-0-2026-108441)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:32
VLAI
EPSS
VEX
Title
Microsoft Office Word Remote Code Execution Vulnerability
Summary
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 00:00 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Affected:
16.0.1 , < https://aka.ms/OfficeSecurityReleases
(custom)
|
|
| Microsoft | Microsoft Office 365 for Mac |
Affected:
1.0.0 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2021 |
Affected:
16.0.1 , < 16.0.14334.20974
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2024 |
Affected:
16.0.0 , < 16.0.17932.21056
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2021 |
Affected:
16.0.1 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2024 |
Affected:
16.0.0 , < 16.114.26101123
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108441",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T03:55:31.107Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office 365 for Mac",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.14334.20974",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.17932.21056",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.14334.20974",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.17932.21056",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:32:55.573Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office Word Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108441"
}
],
"title": "Microsoft Office Word Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108441",
"datePublished": "2026-10-15T20:57:24.439Z",
"dateReserved": "2026-10-09T21:52:56.478Z",
"dateUpdated": "2026-10-20T18:32:55.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108440 (GCVE-0-2026-108440)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:32
VLAI
EPSS
VEX
Title
Microsoft Office Word Remote Code Execution Vulnerability
Summary
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 00:00 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Affected:
16.0.1 , < https://aka.ms/OfficeSecurityReleases
(custom)
|
|
| Microsoft | Microsoft Office 365 for Mac |
Affected:
1.0.0 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2021 |
Affected:
16.0.1 , < 16.0.14334.20974
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2024 |
Affected:
16.0.0 , < 16.0.17932.21056
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2021 |
Affected:
16.0.1 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2024 |
Affected:
16.0.0 , < 16.114.26101123
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108440",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T03:55:34.272Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office 365 for Mac",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.14334.20974",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.17932.21056",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.14334.20974",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.17932.21056",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:32:55.057Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office Word Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108440"
}
],
"title": "Microsoft Office Word Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108440",
"datePublished": "2026-10-15T20:57:23.936Z",
"dateReserved": "2026-10-09T21:52:56.478Z",
"dateUpdated": "2026-10-20T18:32:55.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108439 (GCVE-0-2026-108439)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:32
VLAI
EPSS
VEX
Title
Microsoft Office Word Remote Code Execution Vulnerability
Summary
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 00:00 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Affected:
16.0.1 , < https://aka.ms/OfficeSecurityReleases
(custom)
|
|
| Microsoft | Microsoft Office 365 for Mac |
Affected:
1.0.0 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2021 |
Affected:
16.0.1 , < 16.0.14334.20974
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2024 |
Affected:
16.0.0 , < 16.0.17932.21056
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2021 |
Affected:
16.0.1 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2024 |
Affected:
16.0.0 , < 16.114.26101123
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108439",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T03:55:27.978Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office 365 for Mac",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.14334.20974",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.17932.21056",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.14334.20974",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.17932.21056",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:32:54.526Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office Word Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108439"
}
],
"title": "Microsoft Office Word Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108439",
"datePublished": "2026-10-15T20:57:23.418Z",
"dateReserved": "2026-10-09T21:52:56.478Z",
"dateUpdated": "2026-10-20T18:32:54.526Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108438 (GCVE-0-2026-108438)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:32
VLAI
EPSS
VEX
Title
Microsoft Office Word Information Disclosure Vulnerability
Summary
Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 01:00 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Affected:
16.0.1 , < https://aka.ms/OfficeSecurityReleases
(custom)
|
|
| Microsoft | Microsoft Office 365 for Mac |
Affected:
1.0.0 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2021 |
Affected:
16.0.1 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2024 |
Affected:
16.0.0 , < 16.114.26101123
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108438",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T01:00:36.768671Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T01:13:48.999Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office 365 for Mac",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:32:54.014Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office Word Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108438"
}
],
"title": "Microsoft Office Word Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108438",
"datePublished": "2026-10-15T20:57:22.905Z",
"dateReserved": "2026-10-09T21:52:56.478Z",
"dateUpdated": "2026-10-20T18:32:54.014Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108437 (GCVE-0-2026-108437)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:32
VLAI
EPSS
VEX
Title
Microsoft Office Word Remote Code Execution Vulnerability
Summary
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 00:00 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Affected:
16.0.1 , < https://aka.ms/OfficeSecurityReleases
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2021 |
Affected:
16.0.1 , < 16.0.14334.20974
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2024 |
Affected:
16.0.0 , < 16.0.17932.21056
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108437",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T03:55:26.433Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.14334.20974",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.17932.21056",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.14334.20974",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.17932.21056",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:32:53.424Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office Word Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108437"
}
],
"title": "Microsoft Office Word Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108437",
"datePublished": "2026-10-15T20:57:22.383Z",
"dateReserved": "2026-10-09T21:52:56.478Z",
"dateUpdated": "2026-10-20T18:32:53.424Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108436 (GCVE-0-2026-108436)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:32
VLAI
EPSS
VEX
Title
Microsoft Office Word Information Disclosure Vulnerability
Summary
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 01:00 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Affected:
16.0.1 , < https://aka.ms/OfficeSecurityReleases
(custom)
|
|
| Microsoft | Microsoft Office 365 for Mac |
Affected:
1.0.0 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2021 |
Affected:
16.0.1 , < 16.0.14334.20974
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2024 |
Affected:
16.0.0 , < 16.0.17932.21056
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2021 |
Affected:
16.0.1 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2024 |
Affected:
16.0.0 , < 16.114.26101123
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108436",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T01:00:22.412199Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T01:13:49.243Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office 365 for Mac",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.14334.20974",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.17932.21056",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.14334.20974",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.17932.21056",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:32:52.703Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office Word Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108436"
}
],
"title": "Microsoft Office Word Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108436",
"datePublished": "2026-10-15T20:57:21.960Z",
"dateReserved": "2026-10-09T21:52:56.478Z",
"dateUpdated": "2026-10-20T18:32:52.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108435 (GCVE-0-2026-108435)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:32
VLAI
EPSS
VEX
Title
Microsoft Office Word Information Disclosure Vulnerability
Summary
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 01:00 UTC
CWE
- CWE-822 - Untrusted Pointer Dereference
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Affected:
16.0.1 , < https://aka.ms/OfficeSecurityReleases
(custom)
|
|
| Microsoft | Microsoft Office 365 for Mac |
Affected:
1.0.0 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2021 |
Affected:
16.0.1 , < 16.0.14334.20974
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2024 |
Affected:
16.0.0 , < 16.0.17932.21056
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2021 |
Affected:
16.0.1 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2024 |
Affected:
16.0.0 , < 16.114.26101123
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108435",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T01:00:18.523676Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T01:13:49.377Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office 365 for Mac",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.14334.20974",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.17932.21056",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.14334.20974",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.17932.21056",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-822",
"description": "CWE-822: Untrusted Pointer Dereference",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:32:52.102Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office Word Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108435"
}
],
"title": "Microsoft Office Word Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108435",
"datePublished": "2026-10-15T20:57:21.375Z",
"dateReserved": "2026-10-09T21:52:56.478Z",
"dateUpdated": "2026-10-20T18:32:52.102Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108434 (GCVE-0-2026-108434)
Vulnerability from nvd – Published: 2026-10-15 20:57 – Updated: 2026-10-20 18:32
VLAI
EPSS
VEX
Title
Microsoft Office Word Information Disclosure Vulnerability
Summary
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 01:00 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Affected:
16.0.1 , < https://aka.ms/OfficeSecurityReleases
(custom)
|
|
| Microsoft | Microsoft Office 365 for Mac |
Affected:
1.0.0 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2021 |
Affected:
16.0.1 , < 16.0.14334.20974
(custom)
|
|
| Microsoft | Microsoft Office LTSC 2024 |
Affected:
16.0.0 , < 16.0.17932.21056
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2021 |
Affected:
16.0.1 , < 16.114.26101123
(custom)
|
|
| Microsoft | Microsoft Office LTSC for Mac 2024 |
Affected:
16.0.0 , < 16.114.26101123
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108434",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T01:00:11.494959Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T01:13:49.505Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office 365 for Mac",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.14334.20974",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft Office LTSC 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.17932.21056",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Office LTSC for Mac 2024",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.114.26101123",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*",
"versionEndExcluding": "16.114.26101123",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.14334.20974",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
"versionEndExcluding": "16.0.17932.21056",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:32:51.649Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office Word Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108434"
}
],
"title": "Microsoft Office Word Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108434",
"datePublished": "2026-10-15T20:57:20.932Z",
"dateReserved": "2026-10-09T21:52:56.478Z",
"dateUpdated": "2026-10-20T18:32:51.649Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80092 (GCVE-0-2026-80092)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:12 – Updated: 2026-10-20 18:45
VLAI
EPSS
VEX
Title
Microsoft Identity Web Elevation of Privilege Vulnerability
Summary
Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-17 03:55 UTC
CWE
- CWE-302 - Authentication Bypass by Assumed-Immutable Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | microsoft-identity-web |
Affected:
>=4.16.0 <4.16.1 , < 4.16.1
(custom)
|
|
| Microsoft | microsoft-identity-web |
Affected:
<3.16.0 , < 3.16.0
(custom)
|
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80092",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-17T03:55:57.786472Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T13:05:49.901Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "microsoft-identity-web",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.16.1",
"status": "affected",
"version": "\u003e=4.16.0 \u003c4.16.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"v3"
],
"product": "microsoft-identity-web",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "3.16.0",
"status": "affected",
"version": "\u003c3.16.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:microsoft-identity-web:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.16.1",
"versionStartIncluding": "\u003e=4.16.0 \u003c4.16.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:microsoft-identity-web:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.16.0",
"versionStartIncluding": "\u003c3.16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-302",
"description": "CWE-302: Authentication Bypass by Assumed-Immutable Data",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:45:28.387Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Identity Web Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80092"
}
],
"title": "Microsoft Identity Web Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-80092",
"datePublished": "2026-10-16T17:12:01.521Z",
"dateReserved": "2026-08-25T18:37:59.829Z",
"dateUpdated": "2026-10-20T18:45:28.387Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109461 (GCVE-0-2026-109461)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:11 – Updated: 2026-10-20 18:45
VLAI
EPSS
VEX
Title
Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability
Summary
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 17:32 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Identity Client for NodeJS |
Affected:
5.0.0 , < 7.1.0
(custom)
cpe:2.3:a:microsoft:microsoft_identity_client_for_nodejs:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109461",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T17:32:18.910994Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:22:48.440Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"Windows 10 Version 22H2 for x64-based Systems"
],
"product": "Microsoft Identity Client for NodeJS",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "7.1.0",
"status": "affected",
"version": "5.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:microsoft_identity_client_for_nodejs:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.0",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-15T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:45:26.215Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461"
}
],
"title": "Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-109461",
"datePublished": "2026-10-16T17:11:24.532Z",
"dateReserved": "2026-10-12T17:01:11.370Z",
"dateUpdated": "2026-10-20T18:45:26.215Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}