| CVE-2026-85881 | 高8.0 | Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network. | 13/10/2026 |
| CVE-2026-58617 | 緊急9.8 | Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network. | 14/07/2026 |
| CVE-2026-42831 | 高7.8 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | 12/05/2026 |
| CVE-2026-41614 | 中6.2 | Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally. | 12/05/2026 |
| CVE-2026-41100 | 中4.4 | Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally. | 12/05/2026 |
| CVE-2026-40363 | 高8.4 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | 12/05/2026 |
| CVE-2026-26133 | 高7.1 | AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network. | 16/03/2026 |
| CVE-2026-26134 | 高7.8 | Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally. | 10/03/2026 |
| CVE-2026-26110 | 高7.8 | Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally. | 10/03/2026 |
| CVE-2026-25180 | 中5.5 | Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally. | 10/03/2026 |
| CVE-2026-24285 | 高7.0 | Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. | 10/03/2026 |
| CVE-2025-62199 | 高7.8 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | 11/11/2025 |
| CVE-2025-60724 | 緊急9.8 | Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. | 11/11/2025 |
| CVE-2025-59234 | 高7.8 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | 14/10/2025 |
| CVE-2025-59227 | 高7.8 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | 14/10/2025 |
| CVE-2025-53799 | 中5.5 | Use of uninitialized resource in Windows Imaging Component allows an unauthorized attacker to disclose information locally. | 09/09/2025 |
| CVE-2025-53766 | 緊急9.8 | Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network. | 12/08/2025 |
| CVE-2025-53732 | 高7.8 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | 12/08/2025 |
| CVE-2025-47167 | 高8.4 | Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally. | 10/06/2025 |
| CVE-2025-30388 | 高7.8 | Heap-based buffer overflow in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally. | 13/05/2025 |