Vulnerabilities
Microsoft Fixes Over 24 Remote Code Execution Flaws in Office Suite
Microsoft has patched more than two dozen serious flaws in Office, including remote code execution bugs that could let attackers run code on victims' computers. Users are urged to update promptly.
Ross GrantUpdated 2 min read
The short version
Microsoft has fixed over 24 serious security flaws in its Office software. Some of these could let attackers take control of your computer if you open or preview a malicious document. No attacks have been reported yet, but users should update Office as soon as possible to stay safe.
What happened?
Microsoft has released patches for over 30 vulnerabilities, including more than two dozen remote code execution flaws in its Office suite. The majority of fixes target Word, with others for Excel, Outlook, PowerPoint, and SharePoint. No exploitation in the wild has been reported so far, according to SecurityWeek.
What Microsoft Patched
According to SecurityWeek (opens in a new tab), Microsoft has released fixes for over 30 vulnerabilities, with the majority affecting its Office suite. The most critical are more than two dozen remote code execution (RCE) flaws. RCE flaws allow an attacker to run their own code on a victim’s computer, which can lead to full compromise of the system.
Word received the largest number of patches, while Excel, Outlook, PowerPoint, and SharePoint also had some issues addressed. In addition to RCE bugs, Microsoft fixed several information disclosure vulnerabilities and a security bypass issue in Office. Other Microsoft products, such as ASP.NET Core and the Authentication Library (MSAL) for Node.js, also received security updates for denial-of-service and information disclosure issues.
How the Flaws Could Be Exploited
Most of the RCE flaws require the attacker to send a specially crafted file, such as a malicious Word document, and convince the recipient to open it. Some of the vulnerabilities could be triggered even if the file is only previewed in the Preview Pane, increasing the risk for users who may not even open the file fully.
The technical causes of these vulnerabilities include buffer overflows, off-by-one errors, use-after-free bugs, path traversal, and numeric truncation errors. These are common programming mistakes that can allow attackers to manipulate how software behaves.
Who Is Affected
Anyone using Microsoft Office products, especially Word, is potentially at risk. This includes both Windows and Mac users, as Microsoft released updates for Office LTSC for Mac 2021 and 2024, and for Office 365 for Mac. Organisations and individuals who have not applied the latest security updates are vulnerable.
What Microsoft and Others Have Said
Microsoft stated that none of the newly patched vulnerabilities have been exploited in the wild as zero-days. This means attackers have not yet used these flaws before the patches were released. However, the risk remains high until users apply the updates.
What You Should Do
Users and IT administrators should apply the latest Microsoft Office updates as soon as possible. This is especially important for those who handle documents from external sources or use the Preview Pane feature. Regularly updating software is a key defence against attacks that exploit known vulnerabilities.
What Happens Next
While there are no reports yet of these flaws being used in attacks, cybercriminals often move quickly once details of vulnerabilities become public. Keeping Office and related software up to date is the best way to reduce risk. Security teams should also review their email and document handling policies to limit exposure to malicious files.
Claimed vs confirmed
- Unconfirmed
Microsoft patched more than two dozen RCE flaws in Office.
Reported by SecurityWeek; no primary source from Microsoft yet.
- Unconfirmed
None of the vulnerabilities have been exploited in the wild.
Reported by SecurityWeek as Microsoft's statement; not directly confirmed by Microsoft.
The impact
- Money
- If a breach occurs due to unpatched Office vulnerabilities, organisations could face regulatory fines. Under UK GDPR, fines can reach £17.5m or 4% of global turnover.
- Reputation
- A successful attack exploiting these flaws could damage trust in affected organisations, especially if sensitive data is compromised.
- Customers
- Users who do not update Office are at risk of having their computers taken over by attackers. Applying updates is the best protection.
Why it matters
These flaws could let attackers take over computers using Office, putting personal and business data at risk. Anyone who uses Word, Excel, Outlook, PowerPoint, or SharePoint should update their software to protect themselves.
How does it work?
Remote code execution (RCE) flaws allow attackers to run their own code on a victim's computer. In this case, attackers could send a specially crafted file (like a Word document) and convince the recipient to open or preview it. Technical causes include buffer overflows and other common programming errors.
Key points
- Microsoft patched over two dozen remote code execution flaws in Office.
- Most issues affect Word, but Excel, Outlook, PowerPoint, and SharePoint are also impacted.
- Attackers could exploit these flaws using malicious documents.
- No attacks have been reported yet, but users should update Office immediately.
- Regular patching is essential to protect against known vulnerabilities.
Sources
SecurityWeek
Reference
