# Microsoft Tackles Over 30 Security Vulnerabilities in Office Suite

*Published October 19, 2026*
*Source: [https://www.securityweek.com/microsoft-patches-two-dozen-rce-flaws-in-office/](https://www.securityweek.com/microsoft-patches-two-dozen-rce-flaws-in-office/)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/microsoft-tackles-over-30-security-vulnerabilities-in-office-suite) or [see plans](https://www.sec-news.ai/pricing).*

## Article

Microsoft has addressed more than 30 security vulnerabilities in its Office suite, with a significant focus on remote code execution (RCE) flaws. The company announced the updates shortly after its regular Patch Tuesday release. Among the vulnerabilities, two dozen are high-severity RCE flaws, several of which could be exploited through the Preview Pane. Attackers would typically need to send a specially crafted file and persuade the recipient to open it in order to exploit these flaws. The vulnerabilities primarily stem from buffer overflow issues, including off-by-one errors, use-after-free, path traversal, and numeric truncation errors. The majority of the patches were applied to Word, with a few targeting Excel, Outlook, PowerPoint, and SharePoint. Beyond RCE flaws, Microsoft has resolved multiple information disclosure bugs and a security bypass issue within the Office suite. The company also fixed a denial-of-service defect in ASP.NET Core, an elevation of privilege in Identity Web, and an information disclosure in the MSAL for Node.js. Importantly, Microsoft noted that none of these vulnerabilities have been exploited in the wild as zero-day threats. Additionally, Microsoft updated several advisories to inform customers about new security updates for Office LTSC for Mac 2021 and 2024, as well as for Office 365 for Mac. These updates underscore Microsoft's commitment to maintaining the security integrity of its Office products across different platforms.