Microsoft Word Remote Code Execution Vulnerability
Priority MEDIUM 42Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with the same permissions as the current user. To exploit the vulnerability, a user must open a specially crafted file with an affected version of Microsoft Word software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file. The security update addresses the vulnerability by correcting how Microsoft Word handles files in memory.
Why it matters now
EPSS 0.04885 92nd percentileScored 2026-11-07
Fix Fixed Microsoft SharePoint Enterprise Server 2016 (Microsoft): publicationMicrosoft SharePoint Enterprise Server 2013 Service Pack 1 (Microsoft): publication+12 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Microsoft SharePoint Enterprise Server 2016 | 16.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft SharePoint Enterprise Server 2013 Service Pack 1 | 15.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft SharePoint Server 2019 | 16.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Office 2019 | 19.0.0 to before https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases | Patch available | CNA |
| Microsoft | Microsoft Office 2019 for Mac | 16.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Office 365 ProPlus | 16.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Office Online Server | 16.0.1 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Word 2016 | 16.0.1 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Office 2016 for Mac | 16.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Office 2010 Service Pack 2 | 13.0.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Office Web Apps 2010 Service Pack 2 | 13.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft SharePoint Server 2010 Service Pack 2 | 13.0.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Word 2010 Service Pack 2 | 13.0.0.0 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Word 2013 Service Pack 1 | 15.0.1 to before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Word 2013 Service Pack 1 | 15.0.1 to before publication | publication | Patch available | CNA |
- Microsoft SharePoint Enterprise Server 2016 VendorMicrosoft Affected 16.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft SharePoint Enterprise Server 2013 Service Pack 1 VendorMicrosoft Affected 15.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft SharePoint Server 2019 VendorMicrosoft Affected 16.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Office 2019 VendorMicrosoft Affected 19.0.0 to before https://aka.ms/OfficeSecurityReleases Fixed in https://aka.ms/OfficeSecurityReleases Patch available CNA
- Microsoft Office 2019 for Mac VendorMicrosoft Affected 16.0.0 to before publication Fixed in publication Patch available CNA
- Office 365 ProPlus VendorMicrosoft Affected 16.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Office Online Server VendorMicrosoft Affected 16.0.1 to before publication Fixed in publication Patch available CNA
- Microsoft Word 2016 VendorMicrosoft Affected 16.0.1 to before publication Fixed in publication Patch available CNA
- Microsoft Office 2016 for Mac VendorMicrosoft Affected 16.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Office 2010 Service Pack 2 VendorMicrosoft Affected 13.0.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Office Web Apps 2010 Service Pack 2 VendorMicrosoft Affected 13.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft SharePoint Server 2010 Service Pack 2 VendorMicrosoft Affected 13.0.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Word 2010 Service Pack 2 VendorMicrosoft Affected 13.0.0.0 to before publication Fixed in publication Patch available CNA
- Microsoft Word 2013 Service Pack 1 VendorMicrosoft Affected 15.0.1 to before publication Fixed in publication Patch available CNA
- Microsoft Word 2013 Service Pack 1 VendorMicrosoft Affected 15.0.1 to before publication Fixed in publication Patch available CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:* | 2010 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2016:*:*:*:*:mac_os:*:* | 2016 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:* | 2019 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office:2019:*:*:*:*:macos:*:* | 2019 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_365_proplus:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_online_server:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:office_web_apps:2010:sp2:*:*:*:*:*:* | 2010 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sharepoint_enterprise_server:2013:sp1:*:*:*:*:*:* | 2013 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:* | 2016 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:* | 2010 sp2 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:* Versions 2010 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2016:*:*:*:*:mac_os:*:* Versions 2016 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office:2019:*:*:*:*:macos:*:* Versions 2019 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_365_proplus:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_online_server:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:office_web_apps:2010:sp2:*:*:*:*:*:* Versions 2010 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sharepoint_enterprise_server:2013:sp1:*:*:*:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:* Versions 2016 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:* Versions 2010 sp2 Vulnerable ·Microsoft
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* | 2019 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:* | 2010 sp2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:word:2013:sp1:*:*:*:*:*:* | 2013 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:* | 2013 sp1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:* | 2016 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:* Versions 2010 sp2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:word:2013:sp1:*:*:*:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:* Versions 2016 Vulnerable ·Microsoft
Remediation
- Fix · CNA Microsoft SharePoint Enterprise Server 2016 (Microsoft) Fixed in publication
- Fix · CNA Microsoft SharePoint Enterprise Server 2013 Service Pack 1 (Microsoft) Fixed in publication
- Fix · CNA Microsoft SharePoint Server 2019 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Office 2019 (Microsoft) Fixed in https://aka.ms/OfficeSecurityReleases
- Fix · CNA Microsoft Office 2019 for Mac (Microsoft) Fixed in publication
- Fix · CNA Office 365 ProPlus (Microsoft) Fixed in publication
- Fix · CNA Microsoft Office Online Server (Microsoft) Fixed in publication
- Fix · CNA Microsoft Word 2016 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Office 2016 for Mac (Microsoft) Fixed in publication
- Fix · CNA Microsoft Office 2010 Service Pack 2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Office Web Apps 2010 Service Pack 2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft SharePoint Server 2010 Service Pack 2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Word 2010 Service Pack 2 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Word 2013 Service Pack 1 (Microsoft) Fixed in publication
- Fix · CNA Microsoft Word 2013 Service Pack 1 (Microsoft) Fixed in publication
Timeline
- 2026-10-02 Threatist record created from CVE-2019-1034
- 2026-10-03 Alias added: GHSA-rvm2-34hm-23fm
References
More Microsoft Office vulnerabilities
- TI-2023-09240 Microsoft Outlook Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2019-01013 A remote code execution vulnerability exists in Microsoft Excel software when the… KEVCVSS 3.1HIGH 8.8
- TI-2019-00335 Command injection in Microsoft Office KEVCVSS 3.1HIGH 8.8
- TI-2018-00739 Out-of-bounds write in Microsoft Equation Editor KEVCVSS 3.1HIGH 8.8
- TI-2015-02130 Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2… KEVCVSS 3.1HIGH 8.8
- TI-2015-01588 Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary… KEVCVSS 3.1HIGH 8.8
Sources
- CVE-2019-1034 · CVE Program
- CVE-2019-1034 · NVD
- FIRST EPSS
- GHSA-rvm2-34hm-23fm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences