AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MicrosoftCVE-2026-62804

Microsoft Office Word: code execution

Microsoft

CVE-2026-62804 · Published Sep 8, 2026 · updated Oct 30, 2026

High7.8
No fix yet
Microsoft advisory

External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Affected versions

PackageAffectedFixed in
Microsoft 365 Apps for Enterprise
Product
>= 16.0.1, < https://aka.ms/OfficeSecurityReleaseshttps://aka.ms/OfficeSecurityReleases
Microsoft Office 365 for Mac
Product
all versionsNo fix yet

Changes since it was listed

Fixed inNov 3Fixed in: Microsoft 365 Apps for Enterprise https://aka.ms/OfficeSecurityReleases, Microsoft Office 2016 16.0.5569.1002, Microsoft to Microsoft 365 Apps for Enterprise https://aka.ms/OfficeSecurityReleases
Details and references
CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-73

More Microsoft advisories

All Microsoft
High 8.3Sep 8Microsoft Skype for Business: spoofingCVE-2026-69646fixed in 6.0.9319.885 +2Medium 6.5Sep 8Microsoft Skype for Business: cross-site scriptingCVE-2026-69642fixed in 6.0.9319.885 +2High 7.1Sep 8Microsoft Skype for Business: spoofingCVE-2026-66305fixed in 6.0.9319.885 +2Medium 6.5Sep 8Microsoft Skype for Business: information disclosureCVE-2026-66306fixed in 6.0.9319.885 +2High 7.5Sep 8Microsoft Skype for Business: integer overflowCVE-2026-66307fixed in 6.0.9319.885 +2Medium 6.5Sep 8Microsoft Skype for Business: out-of-bounds readCVE-2026-66308fixed in 6.0.9319.885 +2