Microsoft’s October update patches 41 vulnerabilities in Office, six of them critical

With its October security update released on October 13, Microsoft patched 41 vulnerabilities in the Office family. According to NVD records, the vulnerabilities affect Microsoft 365 Apps, Office LTSC 2021, and Office LTSC 2024 installations, as well as Office versions on the Mac side. Based on Microsoft’s severity labels, 11 of these vulnerabilities are critical, 30 are important, and six top the list with a 9.8 CVSS score. In the company’s assessment, none have been publicly disclosed and none are currently being actively exploited.

Five Outlook vulnerabilities critical at 9.8

The list is heavily weighted toward Outlook: there are 10 vulnerabilities in total, and five of them (CVE-2026-97749, CVE-2026-97016, CVE-2026-88156, CVE-2026-70291, CVE-2026-70242) are critical at 9.8. All five have the vector value AV:N/AC:L/PR:N/UI:N; in other words, the scoring indicates that the attack can be launched over the network, does not require a username or password, and does not depend on the victim opening a file or clicking a link. The remaining Outlook entries include memory overflows at 8.8 (CVE-2026-97012, CVE-2026-70282, CVE-2026-70257, CVE-2026-70256) and an out-of-bounds read at 7.5 that leads to information disclosure (CVE-2026-70281).

The Access, Word, OneNote, and Visio side

Access is the second most crowded product with 12 vulnerabilities: CVE-2026-105717, CVE-2026-105716, CVE-2026-105598, CVE-2026-105597, CVE-2026-105596, CVE-2026-105595, CVE-2026-105593, CVE-2026-105591, CVE-2026-102850, CVE-2026-102849, CVE-2026-105714, and CVE-2026-105592. Most are heap-based memory overflows rated 8.8. Word has three entries (CVE-2026-97001, CVE-2026-96996, CVE-2026-96995), the command injection bug CVE-2026-97781 stands out in OneNote, and CVE-2026-102857 and CVE-2026-102856 are critical in Visio. PowerPoint has five vulnerabilities, and CVE-2026-88178 is critical at 9.8. For most of the vulnerabilities in this group, opening a crafted file is enough to trigger the attack.

Privilege escalation vulnerabilities in Click-To-Run

Four privilege escalation vulnerabilities were patched in Click-To-Run, Office’s update component: CVE-2026-97774, CVE-2026-88109, CVE-2026-85340, and CVE-2026-70276. These vulnerabilities range from 7.0 to 7.8 and require the attacker to already have a limited session on the machine; the goal is to move that session to administrator level. Two vulnerabilities identified across the Office package (CVE-2026-88197, CVE-2026-88196) are also listed at 8.8.

Affected versions and update path

The vulnerabilities affect Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Office LTSC 2021 and Office LTSC 2024 (32/64-bit), and, on the Mac side, Office LTSC for Mac 2021, Office LTSC for Mac 2024, and Office 365 for Mac installations. Microsoft 365 Apps users move to Current Channel Version 2609 (Build 20430.20182) via automatic updates. For volume-licensed Office LTSC 2024, the target build is 17932.21056; for Office LTSC 2021, it is 14334.20974; and for retail Office 2021, it is 20326.20232. Those who do not want to wait for the update can go to the Account section from the File menu in the Office app and use the Update Now command under Update Options; on Mac, Microsoft AutoUpdate is enough.

In Microsoft’s notes, the likelihood of exploitation for these vulnerabilities is marked as low. Still, Office documents remain one of the most common entry points used by attackers. Completing the update before opening Word, Access, or PowerPoint files from unfamiliar sources is the simplest protection step.

Source: Microsoft MSRC · NVD