Back Securityweek

Microsoft Patches Two Dozen RCE Flaws in Office

Securityweek •Ionut Arghire • October 16, 2026

Hot on the heels of its record Patch Tuesday rollout, Microsoft on Thursday announced patches for over 30 new vulnerabilities. Most of the new fixes address security defects in the Office suite. Two dozen of them patch high-severity remote code execution (RCE) flaws, including half a dozen bugs that could be targeted via the Preview Pane. In most cases, exploitation requires an attacker to send a specially crafted file, such as a malicious document, and convince the recipient to open it. Buffer overflow issues are blamed for most of the RCEs, with several defects being off-by-one, use-after-free, path traversal, and numeric truncation errors. Word received the majority of patches, with only a few rolled out for Excel, Outlook, PowerPoint, and SharePoint. In addition to RCE flaws, Microsoft fixed multiple information disclosure bugs and a security bypass issue in the Office suite. Additionally, it resolved a denial-of-service (DoS) defect in ASP.NET Core, an elevation of privilege in Identity Web, and an information disclosure in Authentication Library (MSAL) for Node.js. According to Microsoft, none of the newly resolved issues have been exploited in the wild as a zero-day. On Thursday, Microsoft also updated dozens of advisories initially published on October 13 to notify customers that security updates have been released for Office LTSC for Mac 2021 and 2024, and for Office 365 for Mac. Related: Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution Related: Cisco Warns of Exploited Secure Email Gateway Vulnerability Related: Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise

Most of the new fixes address security defects in the Office suite. Two dozen of them patch high-severity remote code execution (RCE) flaws, including half a dozen bugs that could be targeted via the Preview Pane. In most cases, exploitation requires an attacker to send a specially crafted file, such as a malicious document, and convince the recipient to open it. Buffer overflow issues are blamed for most of the RCEs, with several defects being off-by-one, use-after-free, path traversal, and numeric truncation errors. Word received the majority of patches, with only a few rolled out for Excel, Outlook, PowerPoint, and SharePoint. In addition to RCE flaws, Microsoft fixed multiple information disclosure bugs and a security bypass issue in the Office suite. Additionally, it resolved a denial-of-service (DoS) defect in ASP.NET Core, an elevation of privilege in Identity Web, and an information disclosure in Authentication Library (MSAL) for Node.js. According to Microsoft, none of the newly resolved issues have been exploited in the wild as a zero-day. On Thursday, Microsoft also updated dozens of advisories initially published on October 13 to notify customers that security updates have been released for Office LTSC for Mac 2021 and 2024, and for Office 365 for Mac. Related: Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution Related: Cisco Warns of Exploited Secure Email Gateway Vulnerability Related: Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise

In most cases, exploitation requires an attacker to send a specially crafted file, such as a malicious document, and convince the recipient to open it. Buffer overflow issues are blamed for most of the RCEs, with several defects being off-by-one, use-after-free, path traversal, and numeric truncation errors. Word received the majority of patches, with only a few rolled out for Excel, Outlook, PowerPoint, and SharePoint. In addition to RCE flaws, Microsoft fixed multiple information disclosure bugs and a security bypass issue in the Office suite. Additionally, it resolved a denial-of-service (DoS) defect in ASP.NET Core, an elevation of privilege in Identity Web, and an information disclosure in Authentication Library (MSAL) for Node.js. According to Microsoft, none of the newly resolved issues have been exploited in the wild as a zero-day. On Thursday, Microsoft also updated dozens of advisories initially published on October 13 to notify customers that security updates have been released for Office LTSC for Mac 2021 and 2024, and for Office 365 for Mac. Related: Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution Related: Cisco Warns of Exploited Secure Email Gateway Vulnerability Related: Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise

Buffer overflow issues are blamed for most of the RCEs, with several defects being off-by-one, use-after-free, path traversal, and numeric truncation errors. Word received the majority of patches, with only a few rolled out for Excel, Outlook, PowerPoint, and SharePoint. In addition to RCE flaws, Microsoft fixed multiple information disclosure bugs and a security bypass issue in the Office suite. Additionally, it resolved a denial-of-service (DoS) defect in ASP.NET Core, an elevation of privilege in Identity Web, and an information disclosure in Authentication Library (MSAL) for Node.js. According to Microsoft, none of the newly resolved issues have been exploited in the wild as a zero-day. On Thursday, Microsoft also updated dozens of advisories initially published on October 13 to notify customers that security updates have been released for Office LTSC for Mac 2021 and 2024, and for Office 365 for Mac. Related: Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution Related: Cisco Warns of Exploited Secure Email Gateway Vulnerability Related: Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise

Word received the majority of patches, with only a few rolled out for Excel, Outlook, PowerPoint, and SharePoint. In addition to RCE flaws, Microsoft fixed multiple information disclosure bugs and a security bypass issue in the Office suite. Additionally, it resolved a denial-of-service (DoS) defect in ASP.NET Core, an elevation of privilege in Identity Web, and an information disclosure in Authentication Library (MSAL) for Node.js. According to Microsoft, none of the newly resolved issues have been exploited in the wild as a zero-day. On Thursday, Microsoft also updated dozens of advisories initially published on October 13 to notify customers that security updates have been released for Office LTSC for Mac 2021 and 2024, and for Office 365 for Mac. Related: Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution Related: Cisco Warns of Exploited Secure Email Gateway Vulnerability Related: Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise

In addition to RCE flaws, Microsoft fixed multiple information disclosure bugs and a security bypass issue in the Office suite. Additionally, it resolved a denial-of-service (DoS) defect in ASP.NET Core, an elevation of privilege in Identity Web, and an information disclosure in Authentication Library (MSAL) for Node.js. According to Microsoft, none of the newly resolved issues have been exploited in the wild as a zero-day. On Thursday, Microsoft also updated dozens of advisories initially published on October 13 to notify customers that security updates have been released for Office LTSC for Mac 2021 and 2024, and for Office 365 for Mac. Related: Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution Related: Cisco Warns of Exploited Secure Email Gateway Vulnerability Related: Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise

Additionally, it resolved a denial-of-service (DoS) defect in ASP.NET Core, an elevation of privilege in Identity Web, and an information disclosure in Authentication Library (MSAL) for Node.js. According to Microsoft, none of the newly resolved issues have been exploited in the wild as a zero-day. On Thursday, Microsoft also updated dozens of advisories initially published on October 13 to notify customers that security updates have been released for Office LTSC for Mac 2021 and 2024, and for Office 365 for Mac. Related: Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution Related: Cisco Warns of Exploited Secure Email Gateway Vulnerability Related: Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise

According to Microsoft, none of the newly resolved issues have been exploited in the wild as a zero-day. On Thursday, Microsoft also updated dozens of advisories initially published on October 13 to notify customers that security updates have been released for Office LTSC for Mac 2021 and 2024, and for Office 365 for Mac. Related: Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution Related: Cisco Warns of Exploited Secure Email Gateway Vulnerability Related: Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise

On Thursday, Microsoft also updated dozens of advisories initially published on October 13 to notify customers that security updates have been released for Office LTSC for Mac 2021 and 2024, and for Office 365 for Mac. Related: Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution Related: Cisco Warns of Exploited Secure Email Gateway Vulnerability Related: Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise

Related: Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution Related: Cisco Warns of Exploited Secure Email Gateway Vulnerability Related: Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise

Related: Cisco Warns of Exploited Secure Email Gateway Vulnerability Related: Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise

Related: Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise

Ionut Arghire is an international correspondent for SecurityWeek.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Addresses Two Dozen RCE Flaws in Office Suite On October 16, 2026, Microsoft announced patches for over 30 vulnerabilities, including two dozen high-severity remote code execution (RCE) flaws in its Office suite. Exploitation of these vulnerabilities typically requires an attacker to send a malicious document and convince the recipient to open it. The majority of the RCE flaws are attributed to buffer overflow issues, with various other defects such as off-by-one and use-after-free errors. Microsoft confirmed that none of these vulnerabilities have been exploited in the wild as zero-days. The patches also address multiple information disclosure bugs and a denial-of-service defect in ASP.NET Core. Updates were rolled out for Office LTSC for Mac 2021 and 2024, and Office 365 for Mac. The vulnerabilities were published on October 13 and 15, with CVE-2026-96951 and CVE-2026-102764 having CVSS scores of 8.8 and 9.3, respectively. 2 sources 58

Extracted Entities

Microsoft Patches Two Dozen RCE Flaws in Office

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (4)

Platforms (1)

Tools (1)