Actively exploited · Published Sep 11, 2019 · Assigned by microsoft
CVE-2019-1297
High 8.8 Exploited
In plain English
A high-severity security flaw in Microsoft Excel from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on March 3, 2022). The chance it is exploited in the next 30 days is estimated at 21.8% (higher than 98% of all known vulnerabilities). Apply updates per vendor instructions.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)21.8%top 2.3% of all CVEs
Exploited in the wildYesCISA KEV since Mar 3, 2022
Attack toolingNoneno public tooling known
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Mar 17, 2022.
Official description
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Microsoft Excel | 2010 Service Pack 2 (32-bit editions)2010 Service Pack 2 (64-bit editions)2013 Service Pack 1 (32-bit editions)2013 Service Pack 1 (64-bit editions)2013 RT Service Pack 12016 (32-bit edition)2016 (64-bit edition) |
| Microsoft | Microsoft Office | 2016 for Mac2019 for 32-bit editions2019 for 64-bit editions2019 for Mac |
| Microsoft | Office 365 ProPlus | 32-bit Systems64-bit Systems |