8.8 High Exploited

CVE-2019-1297 Microsoft Excel Remote Code Execution Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Not observed so far

Description

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.

Affected products and versions

Product	Affected versions	Fixed in
Microsoft Excel	Versions not published
Microsoft Office	Versions not published
Office 365 ProPlus	Versions not published

References

portal.msrc.microsoft.com portal.msrc.microsoft.com

Timeline

Published September 11, 2019
Added to the KEV catalogue March 3, 2022
Last modified October 21, 2025

The 37 CVEs of Microsoft Excel →

CVE-2020-1226 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle… Not rated CVE-2020-1225 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle… Not rated CVE-2020-0901 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle… Not rated CVE-2020-0906 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle… Not rated

Track this CVE