Microsoft Patches Two Dozen RCE Flaws in Office Suite
Microsoft has released updates addressing over 30 security vulnerabilities, prominently featuring two dozen high-severity remote code execution bugs across its Office software suite.
Radwan AbdulhadiEditor and technology writer
Microsoft Releases Security Updates for Office Suite
Microsoft has announced patches for over 30 new vulnerabilities, with the vast majority of the fixes addressing security defects found directly within the Office suite. Among these updates are two dozen high-severity remote code execution (RCE) flaws that require attention from system administrators and enterprise users alike. According to details released by the company, half a dozen of these bugs can be specifically targeted via the Preview Pane. Further details are available from SecurityWeek in the original source material.
In the majority of scenarios, successfully exploiting these remote code execution flaws requires an attacker to send a specially crafted file—such as a malicious document—and subsequently convince the recipient to open it. Buffer overflow issues are primarily blamed for most of the RCE vulnerabilities, though several other defect types have also been identified and mitigated. Further details are available from record Patch Tuesday in the original source material.
Detailed Breakdown of Office Vulnerabilities
The underlying technical errors causing these security gaps vary across the codebase. Alongside buffer overflow conditions, Microsoft's patches address off-by-one errors, use-after-free defects, path traversal vulnerabilities, and numeric truncation errors. Word received the vast majority of these patches, while a smaller number of fixes were rolled out for Excel, Outlook, PowerPoint, and SharePoint.
In addition to the extensive list of remote code execution flaws, the software giant also addressed multiple information disclosure bugs and a security bypass issue within the broader Office suite. These additional fixes aim to tighten overall application security and prevent unauthorized data access.
Additional Software Fixes and Platform Updates
Beyond the core Office suite patches, Microsoft resolved a denial-of-service (DoS) defect affecting ASP.NET Core. Furthermore, the company addressed an elevation of privilege vulnerability in Identity Web, as well as an information disclosure issue in the Authentication Library (MSAL) for Node.js.
System administrators can review further guidance and specific technical details by checking the official Microsoft security platform and related documentation. Reviewing these updates helps ensure enterprise environments maintain proper compliance and defense postures.
Zero-Day Status and Mac OS Updates
Importantly, Microsoft confirmed that none of the newly resolved security issues have been actively exploited in the wild as a zero-day. This follows closely behind a record-setting security update cycle from the company earlier in the month.
Additionally, Microsoft updated dozens of advisories initially published on October 13 to notify customers that security updates have been officially released for Office LTSC for Mac 2021 and 2024, as well as for Office 365 for Mac. Users operating these macOS versions are encouraged to apply the updates promptly to maintain a secure working environment.
Sources
- SecurityWeekMicrosoft Patches Two Dozen RCE Flaws in Office
Continue chronologically
Related entity coverage
Related stories
Microsoft unveils new Copilot with Home, Code, and Autopilot
Microsoft introduces new Copilot features including Home, Code, and Autopilot to help users build solutions and manage AI agents across the enterprise.
Microsoft SharePoint Flaw CVE-2026-65660 Active Attacks
Microsoft SharePoint remote code execution vulnerability CVE-2026-65660 is actively exploited in the wild, prompting a strict CISA deadline.
Microsoft Outlook to block MSIX attachments in November
Microsoft announces plans to block .msix and .msixbundle file attachments in Outlook Web and the new Outlook Windows client starting next month.
Microsoft Patches Record 1,413 Vulnerabilities in October
Microsoft's October 2026 Patch Tuesday fixes a record 1,413 vulnerabilities, including an actively exploited Windows zero-day flaw.
