- SecurityWeek reports Microsoft's October fixes include 24 remote code execution flaws, mostly in Office. Six could be targeted through the Preview Pane.
- Preview-based flaws may sidestep the 'do not open unknown files' defence, so patch speed and Preview Pane settings matter alongside staff caution.
- Check Mac Office patch coverage and Preview Pane settings. Also check Edge, Raw Image Extension and Node.js identity library versions, which are separate entries.
The advice to 'not open strange files' has a gap
Most security training rests on one idea: do not open files you do not trust. Microsoft's latest fixes show where that advice may stop working.
SecurityWeek reports that Microsoft announced patches for over 30 new vulnerabilities on Thursday, October 15. Most are in Office. Two dozen fix remote code execution (RCE) flaws, where an attacker can run their own commands on a victim's machine. About six of those could be targeted through the Preview Pane.
The lesson here is that a defence built on human caution only works against attacks that need a human decision. Preview-based flaws may remove that decision.
How these bugs work
In most cases, SecurityWeek says, the attacker must send a booby-trapped file, such as a document, and convince the target to open it. That is the classic path. The attacker sends the file and waits.
Buffer overflows are blamed for most of the RCE bugs. SecurityWeek names four other types of error as well, including use-after-free and path traversal. It does not say how many bugs fall into each type.
A buffer overflow means a program writes more data than a space can hold. The extra data spills into the memory next to it. A crafted file can shape that spill so the program runs the attacker's instructions.
Use-after-free means a program keeps using memory it has already given back. Path traversal means a program is tricked into reaching files outside the folder it should stay in.
The Preview Pane shows a file's contents without the user fully opening it. If a flaw sits in that display code, selecting a file could be enough to trigger it. SecurityWeek says only that these six could be targeted this way. It does not say how easy each one is to exploit.
Where the work landed
Word received most of the patches. Excel, Outlook, PowerPoint and SharePoint received only a few. Microsoft also fixed several information disclosure bugs and one security bypass in Office.
The batch also reaches developer tooling. SecurityWeek lists a denial-of-service flaw in ASP.NET Core, a privilege escalation in Identity Web, and a data exposure in the MSAL library for Node.js.
Microsoft's Security Update Guide lists the last two, both dated October 15. CVE-2026-80092 is in microsoft-identity-web, fixed in version 3.16.0. CVE-2026-109461 is in Microsoft Identity Client for NodeJS, fixed in version 7.1.0. Both are rated Important.
Two more groups of entries in the guide are separate from the Office count. They are dated October 16, a day after the Thursday announcement. SecurityWeek's article does not mention them, and they are not Office products.
The first group is four Microsoft Edge (Chromium-based) RCE entries, each rated Important. All are fixed in build 154.0.4258.37. They are CVE-2026-96199, CVE-2026-96198, CVE-2026-85897 and CVE-2026-85890.
The second is CVE-2026-96202, an RCE in Raw Image Extension that Microsoft rates Critical. It is listed against many Windows 10 and Windows 11 versions. The fixed builds are 2.4.36.0 for Windows 10 and 2.5.35.0 for Windows 11.
The Office CVE identifiers are not in the material reviewed for this story. Teams should pull them from Microsoft's Security Update Guide.
What the sources do and do not say
According to Microsoft, as reported by SecurityWeek, none of the newly fixed flaws was exploited as a zero-day. That describes the day of release. It says nothing about what happens afterwards.
There was a second update on Thursday. Dozens of advisories first issued on October 13 were amended to add Mac coverage. Patches now exist for the 2021 and 2024 LTSC editions of Office for Mac, and for Office 365 for Mac.
Questions to put to your team
First, ask whether Mac Office installs are tracked apart from Windows ones. Those advisories were revised on Thursday to add Mac fixes. A Windows-only patch report would not show that.
Second, ask how quickly Office updates reach every managed machine. Six Preview Pane flaws are the reason speed matters here.
Third, ask whether the Preview Pane is a deliberate choice. Some organisations may decide convenience is worth the risk. That should be a decision someone made, not a default no one reviewed.
Fourth, ask whether the Edge build, the Raw Image Extension version and the Node.js identity libraries follow the same patch process as Office. In many organisations, developers own some of these. That can leave them outside the usual IT inventory.
A patch cycle that ends at 'we told staff to be careful' does not address the Preview Pane. For the six Preview Pane flaws, there may be no deliberate open for staff to refuse.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Microsoft (MSRC).
