Microsoft Patches Two Dozen Office RCE Flaws and Other Security Issues
Microsoft released updates for over 30 vulnerabilities, including 24 remote code execution bugs in Office, with no wild exploitation confirmed.
Key points
- Microsoft patched 24 high-severity remote code execution flaws in its Office suite.
- Six of these vulnerabilities can be targeted through the Preview Pane feature.
- No evidence exists that any of the newly fixed issues have been exploited in the wild.
Microsoft released security updates on Thursday to address more than 30 vulnerabilities, with the majority affecting the Office suite. According to SecurityWeek, the vendor patched two dozen high-severity remote code execution flaws, alongside multiple information disclosure bugs and a security bypass issue within the same software family.
Most of the remote code execution defects stem from buffer overflow issues, though several are attributed to off-by-one errors, use-after-free conditions, path traversal mistakes, and numeric truncation errors. Six of the patched bugs can be targeted via the Preview Pane, while exploitation in most other cases requires an attacker to send a specially crafted file and convince the recipient to open it.
Scope of the Updates
Word received the largest share of the patches, with only a few updates rolled out for Excel, Outlook, PowerPoint, and SharePoint. Beyond the Office applications, Microsoft resolved a denial-of-service defect in ASP.NET Core, an elevation of privilege in Identity Web, and an information disclosure vulnerability in the Authentication Library for Node.js.
Microsoft stated that none of the newly resolved issues have been exploited in the wild as zero-day vulnerabilities. The company also updated dozens of advisories originally published on October 13 to notify customers that security updates are now available for Office LTSC for Mac 2021 and 2024, as well as for Office 365 for Mac.
What should you do?
Security teams should verify that all systems running Microsoft Office and related components have received the latest updates. Administrators should review logs for any attempts to open malformed documents, particularly those that might trigger the Preview Pane. Organizations should also ensure that ASP.NET Core and Identity Web installations are patched to prevent denial-of-service and privilege escalation attacks.
What to do and how to stay safe: Microsoft
- Apply the latest security updates to all Microsoft Office installations, including Word, Excel, Outlook, PowerPoint, and SharePoint.
- Update ASP.NET Core, Identity Web, and the Authentication Library for Node.js to their latest patched versions.
- Monitor email and file transfer logs for attempts to deliver specially crafted documents to users.
- Ensure that Office LTSC for Mac 2021 and 2024, as well as Office 365 for Mac, are updated according to the revised advisories.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are any of these Office vulnerabilities being exploited in the wild?
No, Microsoft stated that none of the newly resolved issues have been exploited in the wild as zero-day vulnerabilities.
Which Microsoft products are affected by these new patches?
The patches primarily affect the Office suite, including Word, Excel, Outlook, PowerPoint, and SharePoint, as well as ASP.NET Core, Identity Web, and the Authentication Library for Node.js.
How can attackers exploit these remote code execution flaws?
In most cases, exploitation requires an attacker to send a specially crafted file and convince the recipient to open it, although six bugs can be targeted via the Preview Pane.
