Skip to content
Exploit Radar Choose my productsProducts My radar

Products › End-user applications

End-user applications

Office, PDF and utilities

Office suites, PDF readers, archivers and utilities installed on workstations.

For example: Microsoft Office, Adobe Acrobat, WinRAR, 7-Zip.

Category RSS feed

Pace of additions

Number of “Office and PDF” vulnerabilities added to CISA’s KEV catalog, per 30-day period (the last one, still in progress, ends on October 3, 2026). Source: CISA KEV catalog.
Catalog additions per 30-day period
PeriodVulnerabilities added
Sep 9, 2025 to Oct 8, 20250
Oct 9, 2025 to Nov 7, 20250
Nov 8, 2025 to Dec 7, 20250
Dec 8, 2025 to Jan 6, 20261
Jan 7, 2026 to Feb 5, 20262
Feb 6, 2026 to Mar 7, 20262
Mar 8, 2026 to Apr 6, 20260
Apr 7, 2026 to May 6, 20265
May 7, 2026 to Jun 5, 20262
Jun 6, 2026 to Jul 5, 20260
Jul 6, 2026 to Aug 4, 20260
Aug 5, 2026 to Sep 3, 20262
Sep 4, 2026 to Oct 3, 2026 (in progress)0

Affected brands

In alphabetical order, with their number of vulnerabilities in this category.

  • 7-Zip 1 vulnerability
  • Adobe 23 vulnerabilities · 3 in the last 12 months
  • DAEMON Tools 1 vulnerability · 1 in the last 12 months
  • Kingsoft 1 vulnerability
  • Microsoft 44 vulnerabilities · 5 in the last 12 months
  • Notepad++ 1 vulnerability · 1 in the last 12 months
  • PaperCut 5 vulnerabilities · 3 in the last 12 months
  • RARLAB 5 vulnerabilities · 1 in the last 12 months

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

See also

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this category.

  1. Rank 1

    PaperCut NG / MFCVE-2026-81578

    PaperCut NG/MF Missing Authentication for Critical Function Vulnerability

    CVSS severity 9.8critical

    Added Aug 31, 2026

  2. Rank 2

    DAEMON Tools LiteCVE-2026-8398

    Daemon Tools Lite Embedded Malicious Code Vulnerability

    CVSS severity 9.8critical

    Added May 27, 2026

  3. Rank 3

    PaperCut NG / MFCVE-2026-82078

    PaperCut NG/MF Unsafe Reflection Vulnerability

    CVSS severity 9.1critical

    Added Aug 31, 2026

  4. Rank 4

    Adobe Acrobat / ReaderCVE-2009-3459

    Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability

    CVE from 2009, added in 2026

    CVSS severity 8.8high

    Added May 20, 2026

  5. Rank 5

    Microsoft OfficeCVE-2009-0238

    Microsoft Office Remote Code Execution

    CVE from 2009, added in 2026

    CVSS severity 8.8high

    Added Apr 14, 2026

  6. Rank 6

    Microsoft OfficeCVE-2009-0556

    Microsoft Office PowerPoint Code Injection Vulnerability

    CVE from 2009, added in 2026

    CVSS severity 8.8high

    Added Jan 7, 2026

  7. Rank 7

    Adobe Acrobat / ReaderCVE-2026-34621

    Adobe Acrobat and Reader Prototype Pollution Vulnerability

    CVSS severity 8.6high

    Added Apr 13, 2026

  8. Rank 8

    Microsoft OfficeCVE-2012-1854

    Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability

    CVE from 2012, added in 2026

    CVSS severity 7.8high

    Added Apr 13, 2026

  9. Rank 9

    Adobe Acrobat / ReaderCVE-2020-9715

    Adobe Acrobat Use-After-Free Vulnerability

    CVE from 2020, added in 2026

    CVSS severity 7.8high

    Added Apr 13, 2026

  10. Rank 10

    Microsoft OfficeCVE-2026-21514

    Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability

    CVSS severity 7.8high

    Added Feb 10, 2026

Show 71 more vulnerabilities
  1. Rank 11

    Microsoft OfficeCVE-2026-21509

    Microsoft Office Security Feature Bypass Vulnerability

    CVSS severity 7.8high

    Added Jan 26, 2026

  2. Rank 12

    RARLAB WinRARCVE-2025-6218

    RARLAB WinRAR Path Traversal Vulnerability

    CVSS severity 7.8high

    Added Dec 9, 2025

  3. Rank 13

    PaperCut NG / MFCVE-2023-27351

    PaperCut NG/MF Improper Authentication Vulnerability

    RansomwareCVE from 2023, added in 2026

    CVSS severity 7.5high

    Added Apr 20, 2026

  4. Rank 14

    Notepad++CVE-2025-15556

    Notepad++ Download of Code Without Integrity Check Vulnerability

    CVSS severity 7.5high

    Added Feb 12, 2026

  5. Rank 15

    PaperCut NG / MFCVE-2023-27350

    PaperCut MF/NG Improper Access Control Vulnerability

    Ransomware

    CVSS severity 9.8critical

    Added Apr 21, 2023

  6. Rank 16

    Microsoft OfficeCVE-2023-23397

    Microsoft Office Outlook Privilege Escalation Vulnerability

    CVSS severity 9.8critical

    Added Mar 14, 2023

  7. Rank 17

    Adobe Acrobat / ReaderCVE-2011-2462

    Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability

    CVE from 2011, added in 2022

    CVSS severity 9.8critical

    Added Jun 8, 2022

  8. Rank 18

    Adobe Acrobat / ReaderCVE-2014-0546

    Adobe Reader and Acrobat Sandbox Bypass Vulnerability

    CVE from 2014, added in 2022

    CVSS severity 9.8critical

    Added May 25, 2022

  9. Rank 19

    Adobe Acrobat / ReaderCVE-2013-2729

    Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability

    CVE from 2013, added in 2022

    CVSS severity 9.8critical

    Added Mar 28, 2022

  10. Rank 20

    Adobe Acrobat / ReaderCVE-2013-3346

    Adobe Reader and Acrobat Memory Corruption Vulnerability

    CVE from 2013, added in 2022

    CVSS severity 9.8critical

    Added Mar 3, 2022

  11. Rank 21

    Microsoft OfficeCVE-2007-0671

    Microsoft Office Excel Remote Code Execution Vulnerability

    CVE from 2007, added in 2025

    CVSS severity 8.8high

    Added Aug 12, 2025

  12. Rank 22

    RARLAB WinRARCVE-2025-8088

    RARLAB WinRAR Path Traversal Vulnerability

    Ransomware

    CVSS severity 8.8high

    Added Aug 12, 2025

  13. Rank 23

    PaperCut NG / MFCVE-2023-2533

    PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability

    CVE from 2023, added in 2025

    CVSS severity 8.8high

    Added Jul 28, 2025

  14. Rank 24

    Microsoft OfficeCVE-2024-38189

    Microsoft Project Remote Code Execution Vulnerability

    CVSS severity 8.8high

    Added Aug 13, 2024

  15. Rank 25

    Microsoft OfficeCVE-2006-2492

    Microsoft Word Malformed Object Pointer Vulnerability

    CVE from 2006, added in 2022

    CVSS severity 8.8high

    Added Jun 8, 2022

  16. Rank 26

    Adobe Acrobat / ReaderCVE-2008-0655

    Adobe Acrobat and Reader Unspecified Vulnerability

    CVE from 2008, added in 2022

    CVSS severity 8.8high

    Added Jun 8, 2022

  17. Rank 27

    Adobe Acrobat / ReaderCVE-2009-3953

    Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability

    CVE from 2009, added in 2022

    CVSS severity 8.8high

    Added Jun 8, 2022

  18. Rank 28

    Adobe Acrobat / ReaderCVE-2018-4990

    Adobe Acrobat and Reader Double Free Vulnerability

    CVE from 2018, added in 2022

    CVSS severity 8.8high

    Added Jun 8, 2022

  19. Rank 29

    Microsoft OfficeCVE-2015-1770

    Microsoft Office Uninitialized Memory Use Vulnerability

    CVE from 2015, added in 2022

    CVSS severity 8.8high

    Added Mar 28, 2022

  20. Rank 30

    Adobe Acrobat / ReaderCVE-2009-0927

    Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability

    CVE from 2009, added in 2022

    CVSS severity 8.8high

    Added Mar 25, 2022

  21. Rank 31

    Microsoft OfficeCVE-2012-1856

    Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability

    CVE from 2012, added in 2022

    CVSS severity 8.8high

    Added Mar 3, 2022

  22. Rank 32

    Adobe Acrobat / ReaderCVE-2014-0496

    Adobe Reader and Acrobat Use-After-Free Vulnerability

    CVE from 2014, added in 2022

    CVSS severity 8.8high

    Added Mar 3, 2022

  23. Rank 33

    Microsoft OfficeCVE-2015-2424

    Microsoft PowerPoint Memory Corruption Vulnerability

    CVE from 2015, added in 2022

    CVSS severity 8.8high

    Added Mar 3, 2022

  24. Rank 34

    Microsoft OfficeCVE-2019-1297

    Microsoft Excel Remote Code Execution Vulnerability

    CVE from 2019, added in 2022

    CVSS severity 8.8high

    Added Mar 3, 2022

  25. Rank 35

    Microsoft OfficeCVE-2012-0158

    Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability

    RansomwareCVE from 2012, added in 2021

    CVSS severity 8.8high

    Added Nov 3, 2021

  26. Rank 36

    Microsoft OfficeCVE-2018-0798

    Microsoft Office Memory Corruption Vulnerability

    CVE from 2018, added in 2021

    CVSS severity 8.8high

    Added Nov 3, 2021

  27. Rank 37

    Adobe Acrobat / ReaderCVE-2021-21017

    Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability

    CVSS severity 8.8high

    Added Nov 3, 2021

  28. Rank 38

    Adobe Acrobat / ReaderCVE-2021-28550

    Adobe Acrobat and Reader Use-After-Free Vulnerability

    CVSS severity 8.8high

    Added Nov 3, 2021

  29. Rank 39

    Kingsoft WPS OfficeCVE-2024-7262

    Kingsoft WPS Office Path Traversal Vulnerability

    CVSS severity 7.8high

    Added Sep 3, 2024

  30. Rank 40

    Adobe Acrobat / ReaderCVE-2023-21608

    Adobe Acrobat and Reader Use-After-Free Vulnerability

    CVSS severity 7.8high

    Added Oct 10, 2023

  31. Rank 41

    Adobe Acrobat / ReaderCVE-2023-26369

    Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability

    CVSS severity 7.8high

    Added Sep 14, 2023

  32. Rank 42

    RARLAB WinRARCVE-2023-38831

    RARLAB WinRAR Code Execution Vulnerability

    Ransomware

    CVSS severity 7.8high

    Added Aug 24, 2023

  33. Rank 43

    Adobe Acrobat / ReaderCVE-2007-5659

    Adobe Acrobat and Reader Buffer Overflow Vulnerability

    CVE from 2007, added in 2022

    CVSS severity 7.8high

    Added Jun 8, 2022

  34. Rank 44

    Microsoft OfficeCVE-2009-0557

    Microsoft Office Object Record Corruption Vulnerability

    CVE from 2009, added in 2022

    CVSS severity 7.8high

    Added Jun 8, 2022

  35. Rank 45

    Microsoft OfficeCVE-2009-0563

    Microsoft Office Buffer Overflow Vulnerability

    CVE from 2009, added in 2022

    CVSS severity 7.8high

    Added Jun 8, 2022

  36. Rank 46

    Adobe Acrobat / ReaderCVE-2009-4324

    Adobe Acrobat and Reader Use-After-Free Vulnerability

    CVE from 2009, added in 2022

    CVSS severity 7.8high

    Added Jun 8, 2022

  37. Rank 47

    Microsoft OfficeCVE-2010-2572

    Microsoft PowerPoint Buffer Overflow Vulnerability

    CVE from 2010, added in 2022

    CVSS severity 7.8high

    Added Jun 8, 2022

  38. Rank 48

    Microsoft OfficeCVE-2013-1331

    Microsoft Office Buffer Overflow Vulnerability

    CVE from 2013, added in 2022

    CVSS severity 7.8high

    Added Jun 8, 2022

  39. Rank 49

    Microsoft OfficeCVE-2012-2539

    Microsoft Word Remote Code Execution Vulnerability

    CVE from 2012, added in 2022

    CVSS severity 7.8high

    Added Mar 28, 2022

  40. Rank 50

    Microsoft OfficeCVE-2021-38646

    Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability

    Ransomware

    CVSS severity 7.8high

    Added Mar 28, 2022

  41. Rank 51

    Adobe Acrobat / ReaderCVE-2008-2992

    Adobe Reader and Acrobat Input Validation Vulnerability

    RansomwareCVE from 2008, added in 2022

    CVSS severity 7.8high

    Added Mar 3, 2022

  42. Rank 52

    Microsoft OfficeCVE-2009-3129

    Microsoft Excel Featheader Record Memory Corruption Vulnerability

    CVE from 2009, added in 2022

    CVSS severity 7.8high

    Added Mar 3, 2022

  43. Rank 53

    Adobe Acrobat / ReaderCVE-2010-0188

    Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability

    RansomwareCVE from 2010, added in 2022

    CVSS severity 7.8high

    Added Mar 3, 2022

  44. Rank 54

    Microsoft OfficeCVE-2010-3333

    Microsoft Office Stack-based Buffer Overflow Vulnerability

    CVE from 2010, added in 2022

    CVSS severity 7.8high

    Added Mar 3, 2022

  45. Rank 55

    Adobe Acrobat / ReaderCVE-2013-0640

    Adobe Reader and Acrobat Memory Corruption Vulnerability

    CVE from 2013, added in 2022

    CVSS severity 7.8high

    Added Mar 3, 2022

  46. Rank 56

    Adobe Acrobat / ReaderCVE-2013-0641

    Adobe Reader Buffer Overflow Vulnerability

    CVE from 2013, added in 2022

    CVSS severity 7.8high

    Added Mar 3, 2022

  47. Rank 57

    Microsoft OfficeCVE-2015-1642

    Microsoft Office Memory Corruption Vulnerability

    CVE from 2015, added in 2022

    CVSS severity 7.8high

    Added Mar 3, 2022

  48. Rank 58

    Microsoft OfficeCVE-2015-2545

    Microsoft Office Malformed EPS File Vulnerability

    CVE from 2015, added in 2022

    CVSS severity 7.8high

    Added Mar 3, 2022

  49. Rank 59

    Microsoft OfficeCVE-2016-7193

    Microsoft Office Memory Corruption Vulnerability

    CVE from 2016, added in 2022

    CVSS severity 7.8high

    Added Mar 3, 2022

  50. Rank 60

    Microsoft OfficeCVE-2016-7262

    Microsoft Office Security Feature Bypass Vulnerability

    CVE from 2016, added in 2022

    CVSS severity 7.8high

    Added Mar 3, 2022

  51. Rank 61

    Microsoft OfficeCVE-2017-0261

    Microsoft Office Use-After-Free Vulnerability

    CVE from 2017, added in 2022

    CVSS severity 7.8high

    Added Mar 3, 2022

  52. Rank 62

    Microsoft OfficeCVE-2017-11826

    Microsoft Office Remote Code Execution Vulnerability

    CVE from 2017, added in 2022

    CVSS severity 7.8high

    Added Mar 3, 2022

  53. Rank 63

    Microsoft OfficeCVE-2017-8570

    Microsoft Office Remote Code Execution Vulnerability

    CVE from 2017, added in 2022

    CVSS severity 7.8high

    Added Feb 25, 2022

  54. Rank 64

    Microsoft OfficeCVE-2014-1761

    Microsoft Word Memory Corruption Vulnerability

    CVE from 2014, added in 2022

    CVSS severity 7.8high

    Added Feb 15, 2022

  55. Rank 65

    RARLAB WinRARCVE-2018-20250

    WinRAR Absolute Path Traversal Vulnerability

    RansomwareCVE from 2018, added in 2022

    CVSS severity 7.8high

    Added Feb 15, 2022

  56. Rank 66

    Microsoft OfficeCVE-2017-0262

    Microsoft Office Remote Code Execution Vulnerability

    CVE from 2017, added in 2022

    CVSS severity 7.8high

    Added Feb 10, 2022

  57. Rank 67

    Microsoft OfficeCVE-2021-42292

    Microsoft Excel Security Feature Bypass

    CVSS severity 7.8high

    Added Nov 17, 2021

  58. Rank 68

    Microsoft OfficeCVE-2015-1641

    Microsoft Office Memory Corruption Vulnerability

    CVE from 2015, added in 2021

    CVSS severity 7.8high

    Added Nov 3, 2021

  59. Rank 69

    Microsoft OfficeCVE-2016-3235

    Microsoft Office OLE DLL Side Loading Vulnerability

    CVE from 2016, added in 2021

    CVSS severity 7.8high

    Added Nov 3, 2021

  60. Rank 70

    Microsoft OfficeCVE-2017-0199

    Microsoft Office and WordPad Remote Code Execution Vulnerability

    RansomwareCVE from 2017, added in 2021

    CVSS severity 7.8high

    Added Nov 3, 2021

  61. Rank 71

    Microsoft OfficeCVE-2017-11774

    Microsoft Office Outlook Security Feature Bypass Vulnerability

    CVE from 2017, added in 2021

    CVSS severity 7.8high

    Added Nov 3, 2021

  62. Rank 72

    Microsoft OfficeCVE-2017-11882

    Microsoft Office Memory Corruption Vulnerability

    RansomwareCVE from 2017, added in 2021

    CVSS severity 7.8high

    Added Nov 3, 2021

  63. Rank 73

    Microsoft OfficeCVE-2018-0802

    Microsoft Office Memory Corruption Vulnerability

    RansomwareCVE from 2018, added in 2021

    CVSS severity 7.8high

    Added Nov 3, 2021

  64. Rank 74

    RARLAB UnRARCVE-2022-30333

    RARLAB UnRAR Directory Traversal Vulnerability

    Ransomware

    CVSS severity 7.5high

    Added Aug 9, 2022

  65. Rank 75

    Microsoft OfficeCVE-2024-38226

    Microsoft Publisher Protection Mechanism Failure Vulnerability

    CVSS severity 7.3high

    Added Sep 10, 2024

  66. Rank 76

    Microsoft OfficeCVE-2023-21715

    Microsoft Office Publisher Security Feature Bypass Vulnerability

    CVSS severity 7.3high

    Added Feb 14, 2023

  67. Rank 77

    Adobe Acrobat / ReaderCVE-2010-2883

    Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability

    CVE from 2010, added in 2022

    CVSS severity 7.3high

    Added Jun 8, 2022

  68. Rank 78

    7-ZipCVE-2025-0411

    7-Zip Mark of the Web Bypass Vulnerability

    CVSS severity 7.0high

    Added Feb 6, 2025

  69. Rank 79

    Microsoft OfficeCVE-2023-36761

    Microsoft Word Information Disclosure Vulnerability

    CVSS severity 6.5medium

    Added Sep 12, 2023

  70. Rank 80

    Microsoft OfficeCVE-2021-27059

    Microsoft Office Remote Code Execution Vulnerability

    CVSS severity 6.5medium

    Added Nov 3, 2021

  71. Rank 81

    Microsoft WordPadCVE-2023-36563

    Microsoft WordPad Information Disclosure Vulnerability

    CVSS severity 5.5medium

    Added Oct 10, 2023

Filed under another category

This vulnerability also concerns this type of product, but is counted in its main category. My radar finds it when you follow this category.

  1. Adobe Flash PlayerCVE-2009-1862

    Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability

    CVE from 2009, added in 2022

    CVSS severity 7.8high

    Added Jun 8, 2022

Follow and verify

Get new vulnerabilities in this category: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.