Microsoft Office Outlook Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+7 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 7.5
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Outlook, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Word Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+7 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Word, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Word Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+7 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Word, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002928 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+8 more)Fix KB5002928
What you should do
If you run the affected products, install Microsoft's update (KB5002928 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002928 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+8 more)Fix KB5002928
What you should do
If you run the affected products, install Microsoft's update (KB5002928 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002928 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+8 more)Fix KB5002928
What you should do
If you run the affected products, install Microsoft's update (KB5002928 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002928 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+8 more)Fix KB5002928
What you should do
If you run the affected products, install Microsoft's update (KB5002928 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002928 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+8 more)Fix KB5002928
What you should do
If you run the affected products, install Microsoft's update (KB5002928 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+5 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+5 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002928 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+8 more)Fix KB5002928
What you should do
If you run the affected products, install Microsoft's update (KB5002928 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002928 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+8 more)Fix KB5002928
What you should do
If you run the affected products, install Microsoft's update (KB5002928 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002927, KB5002928 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+9 more)Fix KB5002927, KB5002928
What you should do
If you run the affected products, install Microsoft's update (KB5002927, KB5002928 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002928 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+8 more)Fix KB5002928
What you should do
If you run the affected products, install Microsoft's update (KB5002928 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Outlook Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+4 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Outlook, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+7 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002928 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+8 more)Fix KB5002928
What you should do
If you run the affected products, install Microsoft's update (KB5002928 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+3 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002928 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+8 more)Fix KB5002928
What you should do
If you run the affected products, install Microsoft's update (KB5002928 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Outlook Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+4 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Outlook, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office PowerPoint Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+7 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 7.5
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office PowerPoint, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Word Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+7 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.1
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Word, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office PowerPoint Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+7 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office PowerPoint, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Outlook Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+7 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Outlook, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office PowerPoint Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+7 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office PowerPoint, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.