Microsoft has patched more than 30 vulnerabilities, including 24 high-severity Office flaws that could allow attackers to compromise systems through crafted documents and the Preview Pane.
Microsoft has followed up its record October patch cycle with another broad security update, this time fixing more than 30 newly disclosed vulnerabilities, the bulk of them in Office. SecurityWeek reported that two dozen of the fixes cover high-severity remote code execution flaws, including several that could be triggered through the Preview Pane. In practical terms, that means an attacker may be able to compromise a system by sending a crafted file, such as a malicious document, and persuading the recipient to interact with it.
The most concentrated risk is in Word, which received the largest share of patches. Smaller numbers of fixes were issued for Excel, Outlook, PowerPoint and SharePoint, while Microsoft also addressed multiple information disclosure bugs and a security bypass issue in the Office suite. According to SecurityWeek, the Office flaws are mostly buffer overflows, alongside off-by-one, use-after-free, path traversal and numeric truncation errors, all of which can create opportunities for code execution when a vulnerable application processes untrusted content.
Microsoft said none of the newly fixed issues had been exploited in the wild as zero-days. It also corrected a denial-of-service flaw in ASP.NET Core, an elevation-of-privilege issue in Identity Web and an information disclosure bug in the Microsoft Authentication Library for Node.js. In a separate administrative update, the company revised advisories first published on 13 October to note that security updates are now available for Office LTSC for Mac 2021 and 2024, as well as Office 365 for Mac.
The release lands in the middle of an unusually heavy Patch Tuesday period. Security researchers including CrowdStrike, Kaspersky and other threat-intelligence teams said Microsoft’s October 2026 security updates addressed well over 1,400 vulnerabilities across its product range, with one actively exploited zero-day already under attack and dozens of critical flaws among the total. Against that backdrop, the latest Office fixes reinforce the same message from defenders: organisations should move quickly on patch deployment, particularly where email gateways, document handling and privileged endpoints are exposed.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
