Microsoft Patches Two Dozen RCE Flaws in Office

Hot on the heels of its record Patch Tuesdayrollout, Microsoft on Thursday announced patches for over 30 new vulnerabilities.

Most of the new fixes address security defects in the Office suite. Two dozen of them patch high-severity remote code execution (RCE) flaws, including half a dozen bugs that could be targeted via the Preview Pane.

In most cases, exploitation requires an attacker to send a specially crafted file, such as a malicious document, and convince the recipient to open it.

Buffer overflow issues are blamed for most of the RCEs, with several defects being off-by-one, use-after-free, path traversal, and numeric truncation errors.

Word received the majority of patches, with only a few rolled out for Excel, Outlook, PowerPoint, and SharePoint.

In addition to RCE flaws, Microsoft fixed multiple information disclosure bugs and a security bypass issue in the Office suite.

Additionally, it resolved a denial-of-service (DoS) defect in ASP.NET Core, an elevation of privilege in Identity Web, and an information disclosure in Authentication Library (MSAL) for Node.js.

According to Microsoft, none of the newly resolved issues have been exploited in the wild as a zero-day.

On Thursday, Microsoft also updated dozens of advisories initially published on October 13 to notify customers that security updates have been released for Office LTSC for Mac 2021 and 2024, and for Office 365 for Mac.