CVE-2019-0540

Name: CVE-2019-0540
Creator: NVD / NIST
Published: 2019-03-05T23:29:00.303+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 12.78%

Last modified Jun 17, 2026

CVE-2019-0540 is a vulnerability of currently unknown severity. A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafted file, which could trick the victim into entering credentials, aka 'Microsoft Office Security Feature Bypass Vulnerability'.. EPSS estimates a 12.78% chance of exploitation in the next 30 days.

Description

A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafted file, which could trick the victim into entering credentials, aka 'Microsoft Office Security Feature Bypass Vulnerability'.

Metrics

EPSS Probability

12.78%

95.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-601

Affected Software

Vendor	Product	Versions	Update
Microsoft	Excel Viewer	All versions	—
Microsoft	Office	2010	Sp2
Microsoft	Office	2013	—
Microsoft	Office	2016	—
Microsoft	Office	2019	—
Microsoft	Office 365 Proplus	All versions	—
Microsoft	Powerpoint Viewer	All versions	—
Microsoft	Word Viewer	All versions	—

References

http://www.securityfocus.com/bid/106863Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0540Patch, Vendor Advisory
http://www.securityfocus.com/bid/106863Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0540Patch, Vendor Advisory

Timeline

Published: Mar 5, 2019
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2019-0540?

How severe is CVE-2019-0540?

Severity scoring for CVE-2019-0540 is pending analysis. The EPSS model estimates a 12.78% probability of exploitation in the next 30 days.

How do I fix CVE-2019-0540?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-0540?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST