CVE-2022-29109

Description

Microsoft Excel Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-29110.

Description (MITRE) cveawg.mitre.org

Pulled from cveawg.mitre.org/api/cve/CVE-2022-29109 on 2026-07-28. Shown when MITRE's text differs from the cvelistV5 mirror.

Microsoft Excel Remote Code Execution Vulnerability

Overview

State: —
Assigner (CNA): —
CVSS severity: MEDIUM
CVSS score: 5.0 / 10
CVSS vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Effective score: 5.0 / 10 MEDIUM source: CNA overview
MSRC score: 7.8 / 10 HIGH MS rating: Important · Remote Code Execution
CWE(s): —
Reserved: —
Published: 2022-05-10 00:00 UTC
Last updated: 2026-02-21 04:01 UTC
Source: https://www.rapid7.com/db/vulnerabilities/microsoft-office-cve-2022-29109/

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2022-05-10 21:15:11 UTC
NVD last modified: 2026-06-17 04:39:35 UTC
NVD CVSS v3.1: 7.8 / 10 HIGH source: secure@microsoft.com
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability subscore: 1.8 / 10
Impact subscore: 5.9 / 10
EPSS score: 0.0266 (probability of exploitation in next 30 days)
EPSS percentile: 84.13% vs all CVEs — higher = more likely to be exploited, as of 2026-07-28

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2022-33520
Assigner: microsoft
Published: May 10, 2022, 8:34:13 PM
Updated: Jan 2, 2025, 6:58:06 PM
EUVD base score (CVSS 3.1): 7.8 / 10
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
EUVD-reported EPSS: 2.6600
Vendors: Microsoft
Products: Microsoft 365 Apps for Enterprise (16.0.1 <https://aka.ms/OfficeSecurityReleases)

Microsoft Office 2019 (19.0.0 <https://aka.ms/OfficeSecurityReleases)

Microsoft Office Online Server (16.0.1 <16.0.10386.20015)

Microsoft Office LTSC 2021 (16.0.1 <https://aka.ms/OfficeSecurityReleases)
Aliases: GHSA-562q-xfhg-99cf

ENISA description: Microsoft Excel Remote Code Execution Vulnerability

EUVD references (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29109

Microsoft Security Response Center MSRC

Microsoft's vendor-authoritative record from the Security Update Guide — its own CVSS score, impact, severity rating, exploit assessment, and KB-article fixes. Refreshed 2026-07-10 04:31 UTC (source: CVRF).

MS severity: Important
Impact: Remote Code Execution
MS CVSS base score: 7.8 / 10 (temporal 6.8)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Exploit assessment: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
Release: 2022-May

Microsoft remediations / KB articles (4)

Click to Run — Vendor Fix / Security Update (fixed build https://aka.ms/OfficeSecurityReleases)
https://docs.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates — None Available / Click to Run
5002205 — Vendor Fix / Security Update (fixed build 16.0.10386.20015)
https://support.microsoft.com/kb/5002205 — None Available / 5002205

Microsoft FAQ (2)

Is the Preview Pane an attack vector for this vulnerability?

No, the Preview Pane is not an attack vector.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

This vulnerability requires that a user with an affected version of Windows access a malicious server. An attacker would have to host a specially crafted server share or website. An attacker would have no way to force users to visit this specially crafted server share or website, but would have to convince them to visit the server share or website, typically by way of an enticement in an email or chat message.

Affected products — CPE 2.3 (7) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*
cpe:2.3:a:microsoft:office:2019:*:*:*:*:-:x64:*
cpe:2.3:a:microsoft:office:2019:*:*:*:*:-:x86:*
cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:x64:*
cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:x86:*
cpe:2.3:a:microsoft:office_online_server:-:*:*:*:*:*:*:*

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (8)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

None Available msrc
MSRC update guide: CVE-2022-29109 msrc
5002205 msrc
None Available msrc
https://support.microsoft.com/en-us/help/5002205 rapid7:support.microsoft.com
https://support.microsoft.com/help/5002205 rapid7:support.microsoft.com
https://attackerkb.com/topics/CVE-2022-29109 rapid7:attackerkb.com
https://www.cve.org/CVERecord?id=CVE-2022-29109 rapid7:www.cve.org

NVD-tagged references (2)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29109 af854a3a-2127-422b-91ae-364da2661108 PatchVendor Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29109 secure@microsoft.com

Remediations (1)

Rapid7 — Solution

rapid7

msft-kb5002205-3af403a8-4dbb-4e8c-b96a-e5498a8d59dd

2026-05-28 22:51 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2022-29109.json.

Not stored.