Microsoft
Microsoft Office 2016
Microsoft Office 2016
The Microsoft Office 2016 reached end of service life on Oct 14, 2025. Third-party maintenance keeps it supported — 24/7 engineering support and same-day replacement parts — at 40-70% below OEM renewal pricing.
End of Service LifeEOSL Date: Oct 14, 2025
Specifications
- product
- office
- release
- 2016
- product Label
- Microsoft Office
- release Label
- 2016
- codename
- lts
- latest Version
- release Date
- 2015-09-22
- maintained
- source Url
- https://endoflife.date/office
Lifecycle Dates
- End of Service Life
- Oct 14, 2025
- Last OEM Support
- Oct 13, 2020
OEM vs. 3rd Party Support
See how 3rd party maintenance compares to traditional OEM support for your Microsoft Office 2016. Get the same level of service at a fraction of the cost.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| 24/7/365 Support | ||
| Same-Day Parts Replacement | Limited | |
| Mixed-Vendor Support | ||
| Flexible Contract Terms | Annual Only | Month-to-Month Available |
| Asset Lifecycle Extension | ||
| OEM-Trained Engineers |
Why Choose 3rd Party Support for Microsoft Office 2016?
Save 40-70%
Dramatically reduce your maintenance costs while maintaining the same level of support coverage.
Extend Asset Life
Continue using your Microsoft Office 2016 well beyond the OEM end-of-life date.
24/7 Expert Support
OEM-trained engineers available around the clock with same-day parts replacement.
Microsoft Office 2016 Support: Frequently Asked Questions
Is the Microsoft Office 2016 still supported?
Microsoft ended support for the Microsoft Office 2016 on Oct 14, 2025. Third-party maintenance remains available and keeps the Microsoft Office 2016 supported with 24/7 engineering support and same-day replacement parts.
When is the Microsoft Office 2016 end of service life (EOSL) date?
Microsoft lists the end of service life for the Microsoft Office 2016 as Oct 14, 2025.
Can I keep using the Microsoft Office 2016 after its EOSL date?
Yes. EOSL means Microsoft stops selling support contracts and issuing updates — the equipment itself keeps working. Third-party maintenance provides engineering support and replacement parts for as long as you choose to run it.
How much does third-party support for the Microsoft Office 2016 cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting Microsoft Office 2016
306 published CVEs affect the Microsoft Office 2016, including 244 rated critical or high severity. Microsoft no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2020-0901 | CRITICAL | 9.8 | May 21, 2020 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users who |
| CVE-2019-1205 | CRITICAL | 9.8 | Aug 14, 2019 | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. The file could then take actions on behalf of the logged-on user with the same permissions as the current user. To exploit the vulnerability, a user must open a specially crafted file with an affected version of Microsof |
| CVE-2016-7277 | CRITICAL | 9.6 | Dec 20, 2016 | Microsoft Office 2016 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." |
| CVE-2019-1109 | CRITICAL | 9.1 | Jul 15, 2019 | A spoofing vulnerability exists when Microsoft Office Javascript does not check the validity of the web page making a request to Office documents.An attacker who successfully exploited this vulnerability could read or write information in Office documents.The security update addresses the vulnerability by correcting the way that Microsoft Office Javascript verifies trusted web pages., aka 'Microsoft Office Spoofing Vulnerability'. |
| CVE-2007-0065 | HIGH | 10.0 | Feb 12, 2008 | Heap-based buffer overflow in Object Linking and Embedding (OLE) Automation in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, Office 2004 for Mac, and Visual basic 6.0 SP6 allows remote attackers to execute arbitrary code via a crafted script request. |
| CVE-2015-6093 | HIGH | 9.3 | Nov 11, 2015 | Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." |
| CVE-2015-2477 | HIGH | 9.3 | Aug 15, 2015 | Microsoft Office 2007 SP3, Office for Mac 2011, Office for Mac 2016, and Word Viewer allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." |
| CVE-2015-2468 | HIGH | 9.3 | Aug 15, 2015 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Word Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." |
| CVE-2009-2496 | HIGH | 9.3 | Aug 12, 2009 | Heap-based buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 SP1, and Office Small Business Accounting 2006 allows remote attackers to execute arbitrary code via unspecified parameters to unknown methods, aka "Office Web Components Heap Corruption |
| CVE-2009-1534 | HIGH | 9.3 | Aug 12, 2009 | Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visual Studio .NET 2003 SP1 allows remote attackers to execute arbitrary code via crafted property values, aka "Office Web Components Buffer Overflow Vulnerability." |
| CVE-2009-0562 | HIGH | 9.3 | Aug 12, 2009 | The Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 SP1, and Office Small Business Accounting 2006 does not properly allocate memory, which allows remote attackers to execute arbitrary code via unspecified vectors that trigger "system state" corruption, aka "Office We |
| CVE-2006-1311 | HIGH | 9.3 | Feb 13, 2007 | The RichEdit component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1; Office 2000 SP3, XP SP3, 2003 SP2, and Office 2004 for Mac; and Learning Essentials for Microsoft Office 1.0, 1.1, and 1.5 allows user-assisted remote attackers to execute arbitrary code via a malformed OLE object in an RTF file, which triggers memory corruption. |
| CVE-2006-4694 | HIGH | 9.3 | Sep 27, 2006 | Unspecified vulnerability in PowerPoint in Microsoft Office 2000, Office XP and Office 2003 allows user-assisted attackers to execute arbitrary code via a crafted record in a PPT file, as exploited by malware such as Exploit:Win32/Controlppt.W, Exploit:Win32/Controlppt.X, and Exploit-PPT.d/Trojan.PPDropper.F. NOTE: it has been reported that the attack vector involves SlideShowWindows.View.GotoNamedShow. |
| CVE-2006-1540 | HIGH | 9.3 | Mar 30, 2006 | MSO.DLL in Microsoft Office 2000, Office XP (2002), and Office 2003 allows user-assisted attackers to cause a denial of service and execute arbitrary code via multiple attack vectors, as originally demonstrated using a crafted document record with a malformed string, as demonstrated by replacing a certain "01 00 00 00" byte sequence with an "FF FF FF FF" byte sequence, possibly causing an invalid array index, in (1) an Excel .xls document, which triggers an access violation in ole32.dll; (2) an |
| CVE-2024-38021 | HIGH | 8.8 | Jul 9, 2024 | Microsoft Outlook Remote Code Execution Vulnerability |
| CVE-2022-34717 | HIGH | 8.8 | Aug 9, 2022 | Microsoft Office Remote Code Execution Vulnerability |
| CVE-2022-21840 | HIGH | 8.8 | Jan 11, 2022 | Microsoft Office Remote Code Execution Vulnerability |
| CVE-2021-28455 | HIGH | 8.8 | May 11, 2021 | Microsoft Jet Red Database Engine and Access Connectivity Engine Remote Code Execution Vulnerability |
| CVE-2020-1583 | HIGH | 8.8 | Aug 17, 2020 | An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data. To exploit the vulnerability, an attacker could craft a special document file and then convince the user to open it. An attacker must know the memory address location where the object was created. The update addresses the vulnerability by changing the way certain Word fu |
| CVE-2020-1498 | HIGH | 8.8 | Aug 17, 2020 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users who |
Showing the 20 most severe of 306 known CVEs.
Get Third Party SupportRelated Microsoft Products
All Microsoft products →Microsoft Office 2016
Save 40-70% vs OEM