Microsoft Patches Two Dozen RCE Flaws in Office

1. Executive summary

Microsoft has released out-of-band patches for more than 30 vulnerabilities, most of them in the Office suite, two dozen of which are high-severity remote code execution flaws. Six of the RCE bugs can be triggered through the Preview Pane, which removes the need for a user to open a malicious document. Microsoft states none of the newly resolved issues have been exploited in the wild as a zero-day. No CVE identifiers, CVSS scores, or CISA KEV entries were resolved for this item, so severity here rests on Microsoft's own high-severity rating and the Preview Pane exposure, not on independently scored data. EMEA financial services firms running Office on managed endpoints should treat the Preview Pane flaws as the priority: mail-delivered documents can trigger them without the recipient clicking anything.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. This is a vendor patch release with no confirmed exploitation, no incident, and no third-party service disruption reported in the source material. The regulatory table is therefore empty by design rather than by omission.

Firms that later confirm exploitation of any of these flaws on their own estate cross into DORA Art. 17 (ICT-related incident management process) and Art. 18 (classification of ICT-related incidents and cyber threats) at that point, and the reporting clock in DORA Art. 19 (reporting of major ICT-related incidents to competent authorities) starts from classification, not from this advisory. Until exploitation is confirmed, the obligation is ordinary patch governance, not incident reporting.

3. Technical analysis & attack chain

The confirmed sequence, as described by Microsoft and SecurityWeek:

1. An attacker crafts a malicious file, typically a document, that targets one of the patched Office flaws.
2. The file is delivered to the target, most commonly as a mail attachment.
3. For the six Preview Pane flaws, rendering the message in the Outlook reading pane is enough to trigger the vulnerable code path. For the remainder, the attacker must convince the recipient to open the file.
4. Successful exploitation results in remote code execution in the context of the Office process.

The root causes are concentrated in memory-safety and parsing errors. Buffer overflow accounts for most of the RCEs. The remainder are off-by-one errors, use-after-free, path traversal, and numeric truncation faults. That mix matters for defenders: use-after-free and off-by-one bugs are frequently reachable through malformed object structures inside a document, which is consistent with the Preview Pane exposure, while path traversal points at file-handling logic rather than pure memory corruption.

Word carries the majority of the patches. Excel, Outlook, PowerPoint, and SharePoint received only a few each. Beyond the RCE class, Microsoft fixed multiple information disclosure bugs and one security bypass issue in Office. The security bypass is the one to watch alongside the RCEs, because a bypass can defeat a protection that would otherwise contain a document-borne exploit.

The release also covers issues outside Office: a denial-of-service defect in ASP.NET Core, an elevation of privilege in Identity Web, and an information disclosure in Authentication Library (MSAL) for Node.js. These are lower priority for most endpoint estates but relevant to teams running .NET services or Node.js authentication flows.

Microsoft also updated dozens of advisories first published on October 13 to note that security updates are available for Office LTSC for Mac 2021 and 2024, and for Office 365 for Mac. Mac estates are in scope for this cycle.

Confidence caveats. No CVE identifiers, CVSS vectors, or affected build numbers appear in the source material, so this advisory cannot map the flaws to specific version ranges. Microsoft's statement that none of the issues were exploited in the wild is single-sourced to the vendor and is accurate only as of the release. The claim that six bugs are Preview Pane reachable is also single-sourced to SecurityWeek's reporting of the release. Treat both as provisional and verify against Microsoft's own advisory pages before you deprioritise anything.

4. Mitigation & containment

P1 (within 24 hours)

• Apply the October Office updates to all endpoints running Word, Excel, Outlook, PowerPoint, and SharePoint clients. Word is the largest share of the patch set and should be patched first.
• Apply the same updates to Office LTSC for Mac 2021 and 2024 and Office 365 for Mac, which Microsoft added to the October 13 advisories.
• Where patching cannot complete inside 24 hours, disable the Outlook Preview Pane by Group Policy (User Configuration > Administrative Templates > Microsoft Outlook > Outlook Options > Other > Preview Pane, set to disabled) on endpoints that handle external mail. This directly removes the trigger for the six Preview Pane flaws and is the single highest-value interim control in this cycle.
• Block or quarantine inbound mail attachments of Office types from external senders at the gateway until the patch baseline is confirmed. This is a blunt control; scope it to the unpatched population rather than the whole estate.

P2 (within 72 hours)

• Patch the ASP.NET Core denial-of-service defect, the Identity Web elevation of privilege, and the MSAL for Node.js information disclosure on any internet-facing or authentication-path service. These are not endpoint issues and will not be caught by an endpoint patch sweep.
• Verify the security bypass fix is applied on any host where Office document protections (Protected View, Application Guard, or equivalent) are relied on as a containment layer. A bypass that survives patching of the RCEs leaves the containment assumption intact on paper only.
• Confirm patch state by build number rather than by "update installed" reporting, since the source gives no version detail and your inventory tooling may not distinguish the October out-of-band release from the October 13 baseline.

P3 (within 7 days)

• Review mail-flow rules and EDR detections for Office child-process behaviour (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE, OUTLOOK.EXE spawning script interpreters or command shells) and tune outbound restrictions on those processes.
• Reconcile the October 13 and October 16 releases in your patch catalogue so the out-of-band updates are not overwritten or skipped by a later baseline image.

5. Indicators of compromise

No indicators of compromise available in the source material. The sources provide no hashes, filenames, domains, IP addresses, or command lines. Microsoft states none of the issues were exploited in the wild, so there is no exploitation telemetry to draw on.

Behavioural indicators

These behaviours are generic to document-borne Office exploitation and are not tied to a specific sample. They are useful for hunting, not for attribution.

6. Detection

Insufficient indicators to author detection rules. The sources contain no distinctive strings, command-line flags, mutex names, file paths, registry keys, or hard-coded values from the vulnerabilities themselves. The only artefacts available are CVE-adjacent product names and vendor headline phrases, which would detect reporting about the flaws rather than the flaws. Detection effort should go into the behavioural hunting described in §5 until Microsoft publishes advisory detail with affected build numbers and technical specifics.

7. Sources

• SecurityWeek, "Microsoft Patches Two Dozen RCE Flaws in Office", https://www.securityweek.com/microsoft-patches-two-dozen-rce-flaws-in-office/, 2026-10-16
• ANSSI France CERT, "Multiples vulnérabilités dans Microsoft Office (14 octobre 2026)", https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1312/, 2026-10-14
• ANSSI France CERT, "Multiples vulnérabilités dans Microsoft Office (10 juin 2026)", https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0727/, 2026-06-10
• ANSSI France CERT, "Multiples vulnérabilités dans Microsoft .Net (14 octobre 2026)", https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1313/, 2026-10-14
• ANSSI France CERT, "Multiples vulnérabilités dans Microsoft Sharepoint (22 juillet 2026)", https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-008/, 2026-07-22
• BleepingComputer, "CISA: Microsoft SharePoint RCE flaw now actively exploited", https://www.bleepingcomputer.com/news/security/cisa-microsoft-sharepoint-rce-flaw-now-actively-exploited/, date not stated in source
• Dark Reading, "Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday", https://www.darkreading.com/vulnerabilities-threats/zero-days-microsoft-october-patch-tuesday, date not stated in source

The SharePoint and .NET items in the source list are separate Microsoft patch cycles and are not part of this Office release. They are included for context only. The BleepingComputer item covers a SharePoint RCE patched in May and exploited later; it does not describe the flaws in this advisory.

8. Adverse Trace position

We assess this as a high-priority patch cycle with no confirmed exploitation, and we are not raising it above that on the strength of the source material alone. The Preview Pane exposure is the reason it is not routine: six flaws that trigger on message rendering mean a mail-delivered document can execute without user interaction, and that is the scenario most likely to reach a financial services endpoint through ordinary business mail. The absence of CVE identifiers, CVSS scores, and KEV status in the verified data means we cannot give you a scored severity, and we will not manufacture one. Client impact is concentrated in endpoint estates running Office, with a secondary exposure for teams running ASP.NET Core, Identity Web, or MSAL for Node.js in authentication paths. We will pull the Microsoft advisory pages for CVE mappings and affected build numbers, re-issue this advisory if any of the flaws are added to CISA KEV or confirmed exploited, and flag the Mac Office LTSC and Office 365 for Mac updates to clients who assumed the October 13 baseline covered them.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.