# CVE-2019-1297

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.

- Page: https://www.vulneraibility.com/cve/CVE-2019-1297
- CVSS: 8.8
- Known exploited: yes, in CISA KEV since 2022-03-03; CISA due date 2022-03-17
- EPSS: 21.80% (percentile 97.7)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-02-07)
- Published: 2019-09-11

## Affected versions

- Microsoft Microsoft Excel: affected 2010 Service Pack 2 (32-bit editions); 2010 Service Pack 2 (64-bit editions); 2013 Service Pack 1 (32-bit editions); 2013 Service Pack 1 (64-bit editions); 2013 RT Service Pack 1; 2016 (32-bit edition); 2016 (64-bit edition)
- Microsoft Microsoft Office: affected 2016 for Mac; 2019 for 32-bit editions; 2019 for 64-bit editions; 2019 for Mac
- Microsoft Office 365 ProPlus: affected 32-bit Systems; 64-bit Systems

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1297
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1297

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.