Microsoft Patches 24 Office Remote Code Execution Flaws

Microsoft released patches Thursday for more than 30 newly identified vulnerabilities, including 24 high-severity remote code execution flaws in Office. Six of the Office flaws could be exploited through the Preview Pane. Microsoft reported that none had been used in a zero-day attack.

Most of the remote code execution flaws require an attacker to send a specially crafted file, such as a malicious document, and persuade the recipient to open it. Successful exploitation could allow the attacker to run code on the affected system.

Word received most of the fixes. Microsoft also issued patches for Excel, Outlook, PowerPoint and SharePoint. Buffer overflows accounted for many of the remote code execution flaws. Other defects involved off-by-one errors, use-after-free conditions, path traversal and numeric truncation.

Microsoft also fixed several Office information disclosure vulnerabilities and a security bypass flaw. Outside Office, the company addressed a denial-of-service vulnerability in ASP.NET Core, an elevation-of-privilege flaw in Identity Web and an information disclosure issue in the Authentication Library for Node.js.

The company updated dozens of advisories first published Oct. 13 to confirm that security updates are available for Office LTSC for Mac 2021 and 2024, as well as Office 365 for Mac.