---
id: CVE-2016-0035
title: >-
  Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1,
  Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack
  SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a
  craft…
summary: >-
  Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1,
  Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack
  SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a
  craft…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-119
vendor: microsoft
product: excel
affected:
  - excel = 2007
  - excel = 2010
  - excel = 2013
  - excel = 2016
  - excel_for_mac = 2011
  - excel_for_mac = 2016
  - excel_viewer
  - office_compatibility_pack
published: '2016-01-13'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T16:17:10.940'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2016-0035'
references:
  - url: 'http://www.securitytracker.com/id/1034651'
    label: secure@microsoft.com
  - url: 'http://www.zerodayinitiative.com/advisories/ZDI-15-639'
    label: secure@microsoft.com
  - url: >-
      https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-004
    label: secure@microsoft.com
  - url: 'http://www.securitytracker.com/id/1034651'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.zerodayinitiative.com/advisories/ZDI-15-639'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-004
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
epss: 0.22162
epssPercentile: 0.97641
zeroDay: true
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T15:07:23.342679Z'
ingestedAt: '2026-10-15T16:13:11.756Z'
---

## Overview

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

## Affected

- `excel = 2007`
- `excel = 2010`
- `excel = 2013`
- `excel = 2016`
- `excel_for_mac = 2011`
- `excel_for_mac = 2016`
- `excel_viewer`
- `office_compatibility_pack`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.