CVE-2023-23396: Microsoft office online server uncontrolled resource consumption vulnerability

Microsoft · Office Online Server

Microsoft Excel Denial of Service Vulnerability

6.5 CVSS 3.1 Medium EPSS 3.8% · top 9.7% CWE-400 · Uncontrolled resource consumption

6.5CVSS 3.1 base score

3.8%EPSS exploitation probability, 30 days

NoNot in CISA KEV

2Affected product versions listed by NVD

2References

17 Jun 2026Last modified by NVD

Description

Microsoft Excel Denial of Service Vulnerability

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Office Online Server Microsoft

Office Web Apps Server Microsoft

References

Link	Tags
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23396	PatchVendor Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23396	PatchVendor Advisory

Track CVE-2023-23396 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2017-11826Microsoft Office memory corruption allows remote code executionMicrosoft Office, Word, SharePoint, Office Web Apps and related products fail to properly handle objects in memory, a buffer overflow (CWE-119) that …KEVEPSS 82%analysed13 Oct 2017 7.8CVE-2014-1761Microsoft Word RTF memory corruption remote code executionMicrosoft Word and related Office components mishandle crafted RTF data, causing an out-of-bounds write (CWE-787) that corrupts memory. The flaw affe…KEVEPSS 78%analysed25 Mar 2014 9.8CVE-2023-21716Microsoft Word integer overflow remote code executionCVE-2023-21716 is a critical remote code execution flaw in Microsoft Word, tied to an integer overflow (CWE-190). The record gives only a one-line de…EPSS 85%analysed14 Feb 2023 9.8CVE-2019-1205Microsoft office vulnerabilityA remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfu…EPSS 4.0%14 Aug 2019 9.3CVE-2015-6093Microsoft office memory buffer overflow vulnerabilityMicrosoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word Automation Services on SharePoint Server 2010 SP2 …EPSS 23%11 Nov 2015 9.3CVE-2015-1682Microsoft excel memory buffer overflow vulnerabilityMicrosoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 SP1, Excel 2013 SP1, PowerPoint 2013 SP1, Word 2013 SP1, O…EPSS 20%13 May 2015 9.3CVE-2015-0086Microsoft office vulnerabilityMicrosoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 Gold and SP1, Word 2013 RT Gold and SP1, Word Viewer, Office Compatibility Pack SP…EPSS 15%11 Mar 2015 9.3CVE-2015-0085Microsoft excel vulnerabilityUse-after-free vulnerability in Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, Power…EPSS 19%11 Mar 2015

Source: NIST National Vulnerability Database (record CVE-2023-23396), CISA KEV, FIRST EPSS (scores of 2026-11-13). This page is refreshed as NVD updates the record.