The NIST database holds records for Microsoft Office vulnerabilities, however it only lists the application (i.e. Word 2016) and the service pack. Microsoft release hotfixes outside of service packs, therefore the NIST data alone isn't enough to tell if an installation of Office is vulnerable or not.

For example CVE-2019-1201:


which can be patched in Word 2016 with the 4475540 update.

The Word executable has a build number, such as 16.0.4229.1024, is there any way to use this build number to identify what vulnerabilities exist or have already been patched?

For example, I'd like to replicate the behaviour NIST has for Adobe, where all versions up to a build number are specified, such as CVE-2018-4890


Up to (including) 17.011.30070


Microsoft provides extensive release notes for all of their products. They clearly label patches that fix a security defect.


  • I cannot find anything that maps a build number to a fix using the link you provided, is there something I'm missing? For example docs.microsoft.com/en-us/officeupdates/… doesn't include CVE-2019-1201. It also doesn't allow me to map to the product build number for Excel/Word etc.
    – Neil P
    May 13 '20 at 7:44
  • 1
    If you still into the kb articles about each update it has the new version numbers of files. That said, evaluate security based on whether the patch is installed! May 13 '20 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.