Microsoft
Microsoft Publisher: vulnerabilidades y CVE
Microsoft Publisher tiene 45 vulnerabilidades publicadas, 2 de ellas en los últimos 12 meses. 0 son críticas y 2 figuran en el catálogo de explotación activa de CISA.
CVE45
Últimos 12 meses2
Críticas0
Explotadas activamente2
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2007-0671 | Alta (8.8) | 43% | ⚠ Explotación activa | 3 feb 2007 | Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as… |
| CVE-2024-38226 | Alta (7.3) | 2.7% | ⚠ Explotación activa | 10 sept 2024 | Microsoft Publisher Security Feature Bypass Vulnerability |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-81385 | Alta (8.8) | 1.3% | — | 8 sept 2026 | Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69742 | Alta (8.8) | 0.82% | — | 8 sept 2026 | Integer overflow or wraparound in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network. |
| CVE-2024-38226 | Alta (7.3) | 2.7% | ⚠ Explotación activa | 10 sept 2024 | Microsoft Publisher Security Feature Bypass Vulnerability |
| CVE-2024-20673 | Alta (7.8) | 1.2% | — | 13 feb 2024 | Microsoft Office Remote Code Execution Vulnerability |
| CVE-2023-28295 | Alta (7.8) | 0.74% | — | 17 jun 2023 | Microsoft Publisher Remote Code Execution Vulnerability |
| CVE-2023-28287 | Alta (7.8) | 0.74% | — | 17 jun 2023 | Microsoft Publisher Remote Code Execution Vulnerability |
| CVE-2022-29107 | Media (5.5) | 3.1% | — | 10 may 2022 | Microsoft Office Security Feature Bypass Vulnerability |
| CVE-2020-0760 | Alta (8.8) | 8.8% | — | 15 abr 2020 | A remote code execution vulnerability exists when Microsoft Office improperly loads arbitrary type libraries, aka 'Microsoft Office Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0991. |
| CVE-2018-8245 | Alta (7.8) | 17% | — | 14 jun 2018 | A remote code execution vulnerability exists when Microsoft Publisher fails to utilize features that lock down the Local Machine zone when instantiating OLE objects, aka "Microsoft Publisher Remote Code Execution… |
| CVE-2017-8725 | Alta (7.8) | 20% | — | 13 sept 2017 | A remote code execution vulnerability exists in Microsoft Publisher 2007 Service Pack 3 and Microsoft Publisher 2010 Service Pack 2 when they fail to properly handle objects in memory, aka "Microsoft Office Publisher… |
| CVE-2016-7289 | Alta (7.8) | 25% | — | 20 dic 2016 | Microsoft Publisher 2010 SP2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." |
| CVE-2015-2503 | Alta (9.3) | 17% | — | 11 nov 2015 | Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2007 IME (Japanese) SP3, Access 2010 SP2,… |
| CVE-2014-1759 | Alta (9.3) | 14% | — | 8 abr 2014 | pubconv.dll in Microsoft Publisher 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference and application crash) via a crafted .pub file, aka… |
| CVE-2013-1329 | Alta (9.3) | 21% | — | 15 may 2013 | Integer signedness error in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers a buffer underflow, aka "Publisher Buffer Underflow Vulnerability." |
| CVE-2013-1328 | Alta (9.3) | 21% | — | 15 may 2013 | Microsoft Publisher 2003 SP3, 2007 SP3, and 2010 SP1 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers incorrect pointer handling, aka "Publisher Pointer Handling… |
| CVE-2013-1327 | Alta (9.3) | 21% | — | 15 may 2013 | Integer signedness error in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers an improper memory allocation, aka "Publisher Signed Integer… |
| CVE-2013-1323 | Alta (9.3) | 21% | — | 15 may 2013 | Microsoft Publisher 2003 SP3 does not properly handle NULL values for unspecified data items, which allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Incorrect NULL Value… |
| CVE-2013-1322 | Alta (10) | 25% | — | 15 may 2013 | Microsoft Publisher 2003 SP3 does not properly check table range data, which allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Invalid Range Check Vulnerability." |
| CVE-2013-1321 | Alta (9.3) | 22% | — | 15 may 2013 | Microsoft Publisher 2003 SP3 does not properly check the data type of an unspecified return value, which allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Return Value… |
| CVE-2013-1320 | Alta (10) | 29% | — | 15 may 2013 | Buffer overflow in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Buffer Overflow Vulnerability." |
| CVE-2013-1319 | Alta (10) | 25% | — | 15 may 2013 | Microsoft Publisher 2003 SP3 does not properly check the return value of an unspecified method, which allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Return Value Handling… |
| CVE-2013-1318 | Alta (10) | 26% | — | 15 may 2013 | Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers access to an invalid pointer, aka "Publisher Corrupt Interface Pointer Vulnerability." |
| CVE-2013-1317 | Alta (9.3) | 21% | — | 15 may 2013 | Integer overflow in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers an improper allocation-size calculation, aka "Publisher Integer Overflow… |
| CVE-2013-1316 | Alta (9.3) | 22% | — | 15 may 2013 | Microsoft Publisher 2003 SP3 does not properly validate the size of an unspecified array, which allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Negative Value Allocation… |
| CVE-2011-3412 | Alta (9.3) | 26% | — | 14 dic 2011 | Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, allows remote attackers to execute arbitrary code via a crafted Publisher file that leverages incorrect memory handling, aka "Publisher Memory Corruption… |
| CVE-2011-3411 | Alta (9.3) | 27% | — | 14 dic 2011 | Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that leverages incorrect handling of values in memory, aka "Publisher Invalid Pointer Vulnerability." |
| CVE-2011-3410 | Alta (9.3) | 29% | — | 14 dic 2011 | Array index error in Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, allows remote attackers to execute arbitrary code via a crafted Publisher file that leverages incorrect handling of values in memory, aka… |
| CVE-2011-1508 | Alta (9.3) | 14% | — | 14 dic 2011 | Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, does not properly manage memory allocations for function pointers, which allows user-assisted remote attackers to execute arbitrary code via a crafted Publisher file,… |
| CVE-2010-3955 | Alta (9.3) | 19% | — | 16 dic 2010 | pubconv.dll (aka the Publisher Converter DLL) in Microsoft Publisher 2002 SP3 does not properly perform array indexing, which allows remote attackers to execute arbitrary code via a crafted Publisher file that uses an… |
| CVE-2010-3954 | Alta (9.3) | 21% | — | 16 dic 2010 | Microsoft Publisher 2002 SP3, 2003 SP3, and 2010 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Publisher file, aka "Microsoft Publisher Memory… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.