SecurityWeek reported that Microsoft released fixes on Thursday for over 30 new vulnerabilities, mostly in Office. Two dozen are high-severity remote code execution flaws, which let an attacker run commands on a victim's computer. Six could be targeted through the Preview Pane. Word got most of the patches. Microsoft also fixed bugs in ASP.NET Core, Identity Web and the MSAL library for Node.js.
Microsoft says none of the new flaws were attacked as zero-days, meaning before a fix existed. SecurityWeek says most need a crafted file that the recipient opens. Buffer overflows cause most of the code flaws. In general, a file packs in more data than a program expects, and the spill lets attacker code run. The report gives no CVE numbers and does not say which apps hold the Preview Pane bugs. Per advisories first posted October 13, updates for Office LTSC for Mac 2021 and 2024 and Office 365 for Mac are also out.
Inference: the Preview Pane shows a file's contents without opening it, so those six bugs may shrink the risk from "a user must open a file" to "a file only has to arrive." Leaders can ask three things. Can our patching absorb a batch this size? Do Mac Office installs follow the same process? Is Preview Pane off for high-risk mailboxes?