Microsoft patches 30 vulnerabilities in second October Office update

On October 15, Microsoft released October’s second Office security update. According to the company’s MSRC records, this wave closes 30 vulnerabilities covering Word, Excel, Outlook, PowerPoint, and SharePoint. 22 of the vulnerabilities allow remote code execution, and three are labeled critical. Microsoft notes that none of the vulnerabilities have been publicly disclosed and none are currently being actively exploited.

Word carries the bulk of the list

23 of the 30 records concern Word. 18 of these are remote code execution vulnerabilities, and most have a CVSS score of 8.8: CVE-2026-108426, CVE-2026-108427, CVE-2026-108428, CVE-2026-108429, CVE-2026-108430, CVE-2026-108431, CVE-2026-108432, CVE-2026-108437, CVE-2026-108441, CVE-2026-108442, CVE-2026-108443, CVE-2026-108445, CVE-2026-108447, CVE-2026-108449, CVE-2026-108450, and CVE-2026-108451. The two records marked critical are CVE-2026-108439 and CVE-2026-108440. Most of the bugs are memory overflows and use-after-free errors triggered by opening a crafted file. According to Microsoft’s records, the Preview Pane is not an attack vector for these vulnerabilities; the file must be opened.

On the Word side, a 7.8-rated security feature bypass vulnerability (CVE-2026-108433) and four 6.5-rated information disclosure records were also patched: CVE-2026-108434, CVE-2026-108435, CVE-2026-108436, and CVE-2026-108438.

Excel, Outlook, PowerPoint, and SharePoint

Excel has an 8.8-rated remote code execution vulnerability (CVE-2026-108446) and another code execution record identified across the Office suite (CVE-2026-108444). CVE-2026-108448 in Outlook is critical; it has a score of 7.5 and requires more difficult conditions for a successful attack. CVE-2026-108452, which affects SharePoint Server Subscription Edition, is rated 8.8 and requires an authenticated user account for exploitation. On the PowerPoint side, three 6.5-rated information disclosure vulnerabilities (CVE-2026-108453, CVE-2026-108454, CVE-2026-108455) were closed.

Which versions are affected and how to update

The vulnerabilities affect Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Office LTSC 2021, Office LTSC 2024, Office 365 for Mac, and Office LTSC 2021/2024 for Mac. Microsoft 365 Apps installations automatically update to build 16.0.17932.21056, Office LTSC 2024 to the same build, and Office LTSC 2021 to build 16.0.14334.20974. On the Mac side, the target version is 16.114.26101123, and the fix for SharePoint Server Subscription Edition is in build 16.0.20326.20190. To check whether Office is up to date, go to the Account section from the File menu and look at the version information under Update Options; in enterprise deployments, patches come through the Microsoft 365 Apps update channel.

Source: Microsoft MSRC · NVD