CVE Intelligence

Ascensio vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Ascensio products: 2 record(s), with severity, exploitation and fixes.

ONLYOFFICE DesktopEditors 1ONLYOFFICE DocumentServer 1

Exploited only (KEV) →

CVE-2026-41034 Medium · 5.0 CWE-125 Apr 16, 2026
Out-of-bounds Read in Ascensio ONLYOFFICE DocumentServer
ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and other vectors), leading to an information leak and ASLR bypass.
CVE-2026-41030 Medium · 6.2 CWE-669 Apr 16, 2026
Incorrect Resource Transfer Between Spheres in Ascensio ONLYOFFICE DesktopEditors
In ONLYOFFICE DesktopEditors before 9.3.0, the update service allows attackers to perform actions on files with SYSTEM privileges.