MICROSOFT has released security updates addressing over 30 new vulnerabilities, with the majority focused on the Office suite. The briefing highlights that two dozen of these fixes are high‑severity remote code execution (RCE) flaws, including several that could be triggered via the Preview Pane. Exploitation typically requires a user to open a specially crafted file, such as a malicious document.
The report notes that many of the RCEs stem from buffer overflow conditions, with other defects arising from off-by-one errors, use‑after‑free faults, path traversal and numeric truncation issues. Word accounts for the bulk of the patches, though there were additional fixes for Excel, Outlook, PowerPoint and SharePoint.
Beyond RCEs, Microsoft also patched information disclosure bugs and a security bypass in Office. The update slate also includes fixes for a denial‑of‑service in ASP[.]NET Core, an elevation of privilege in Identity Web, and an information disclosure in the Authentication Library (MSAL) for Node[.]js. Microsoft states that none of the newly resolved issues have been exploited in the wild as zero‑days.
In addition to Windows and Office updates, Microsoft refreshed advisories published on 13 October to notify customers that security updates are available for Office LTSC for Mac 2021 and 2024, and for Office 365 for Mac.