Microsoft Ships Fixes for Dozens of Office and .NET Security Flaws
Patches address high-severity remote code execution bugs in Word and Excel, alongside issues in Identity Web and MSAL libraries.
Key points
- More than 30 new vulnerabilities were patched by Microsoft in a Thursday update.
- Two dozen flaws allow remote code execution, with Word receiving the most fixes.
- Microsoft states none of these newly resolved issues have been exploited in the wild.
Microsoft released security updates on Thursday addressing more than 30 vulnerabilities across its software portfolio. The majority of these fixes target defects within the Office suite, specifically addressing high-severity remote code execution flaws. According to SecurityWeek, two dozen of the patched issues allow attackers to execute arbitrary code on affected systems.
How it unfolded
- Microsoft announced the release of patches for over 30 new vulnerabilities on a Thursday.
- The company updated dozens of advisories originally published on October 13 to include fixes for Office LTSC for Mac 2021 and 2024.
- Updates were also provided for Office 365 for Mac as part of this broader security release cycle.
Who is affected
The primary impact falls on users of the Microsoft Office application suite. Word received the largest number of patches, while Excel, Outlook, PowerPoint, and SharePoint also received updates for specific security defects. SecurityWeek reported that half a dozen of the remote code execution bugs could potentially be targeted via the Preview Pane. Most exploitation scenarios involve an attacker sending a specially crafted file, such as a malicious document, to a recipient.
Beyond the Office applications, the updates resolve issues in several developer-focused components. A denial-of-service defect in ASP.NET Core was addressed, along with an elevation of privilege flaw in Identity Web. Additionally, an information disclosure issue in the Authentication Library (MSAL) for Node.js was fixed. These components affect a wide range of applications built on Microsoft platforms.
Our take on the response
Microsoft confirmed that none of the newly resolved issues have been exploited in the wild as zero-day vulnerabilities. This suggests the fixes are preventive rather than reactive to active attacks. However, the high severity of the remote code execution flaws, particularly those involving buffer overflows and use-after-free errors, underscores the risk. The inclusion of fixes for Mac versions of Office LTSC and Office 365 indicates a comprehensive approach to securing the suite across platforms.
Who needs to act first
Managed service providers should prioritize updating systems that face external internet exposure, such as public-facing SharePoint servers or mail servers running Outlook components. Teams usually schedule updates during maintenance windows to minimize disruption to business operations. It is advisable to test the patches in a non-production environment first to ensure compatibility with existing scripts and plugins. Verify that backup systems are current before applying updates to critical infrastructure. Monitor logs for any unusual activity during the deployment phase to catch potential issues early.
What to do and how to stay safe: Microsoft
- Verify which versions of Office applications are installed on managed endpoints and servers to ensure they match the patched versions.
- Check for systems running ASP.NET Core, Identity Web, or MSAL for Node.js and apply the relevant security updates.
- Review email security policies to ensure that macro execution and unsolicited document handling are restricted for users.
- Monitor network traffic for any signs of attempts to exploit the known buffer overflow or use-after-free vulnerabilities.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are any of these Office vulnerabilities currently being exploited in the wild?
No, Microsoft stated that none of the newly resolved issues have been exploited in the wild as zero-day vulnerabilities.
Which Office application received the most security patches in this update?
Word received the majority of the patches, with only a few updates rolled out for Excel, Outlook, PowerPoint, and SharePoint.
Do these updates apply to Mac versions of Microsoft Office?
Yes, Microsoft updated advisories to notify customers that security updates have been released for Office LTSC for Mac 2021 and 2024, as well as for Office 365 for Mac.
