Microsoft Addresses Two Dozen RCE Flaws in Office Suite

• •Microsoft patched over 30 vulnerabilities, including 24 high-severity RCE flaws.
• •Exploitation typically requires a user to open a malicious document.
• •None of the vulnerabilities have been exploited as zero-days.

On October 16, 2026, Microsoft announced patches for over 30 vulnerabilities, including two dozen high-severity remote code execution (RCE) flaws in its Office suite. Exploitation of these vulnerabilities typically requires an attacker to send a malicious document and convince the recipient to open it. The majority of the RCE flaws are attributed to buffer overflow issues, with various other defects such as off-by-one and use-after-free errors. Microsoft confirmed that none of these vulnerabilities have been exploited in the wild as zero-days. The patches also address multiple information disclosure bugs and a denial-of-service defect in ASP.NET Core. Updates were rolled out for Office LTSC for Mac 2021 and 2024, and Office 365 for Mac. The vulnerabilities were published on October 13 and 15, with CVE-2026-96951 and CVE-2026-102764 having CVSS scores of 8.8 and 9.3, respectively.