Microsoft Patches Two Dozen RCE Flaws in Office

Microsoft patched more than 30 vulnerabilities, primarily in the Office suite, including approximately 24 high-severity remote code execution flaws. These RCE vulnerabilities stem from various memory corruption and logic errors such as buffer overflows, off-by-one errors, use-after-free, path traversal, and numeric truncation. Exploitation typically requires delivering a malicious file to a user who then opens it, with Word being the most affected application. The update also addresses multiple information disclosure bugs and a security bypass issue in Office. Microsoft confirmed no zero-day exploitation in the wild for these issues. Additional security updates were released for Office LTSC for Mac 2021 and 2024, and Office 365 for Mac.

Successful exploitation of these vulnerabilities could allow remote attackers to execute arbitrary code on affected systems, potentially leading to full system compromise. The requirement for user interaction (opening a malicious file) limits the attack vector to social engineering or phishing scenarios. The presence of multiple memory corruption and logic errors increases the risk of exploitation if unpatched. No active exploitation has been observed, reducing immediate risk but underscoring the importance of timely patching.

Microsoft has released official security updates that address these vulnerabilities. Organizations should apply the latest Office patches promptly to mitigate the risk of remote code execution and other security issues. Since these are not cloud service vulnerabilities, local patching is required. No additional mitigation actions are specified by Microsoft beyond applying the updates.