Microsoft patches 114 Office flaws, four critical RCEs

Microsoft fixed 114 vulnerabilities across Office products, including four unauthenticated remote code execution flaws (CVSS 9.8) in Office, Outlook, and Skype.

NCSC-NL relayed Microsoft's Patch Tuesday advisory covering 114 vulnerabilities across Microsoft Office and related components (Outlook, Skype). The four most severe issues — CVE-2026-78505 (Office), CVE-2026-78509 and CVE-2026-78510 (Outlook), and CVE-2026-66302 (Skype) — carry a CVSS score of 9.8 and could allow an attacker to execute arbitrary code without prior authentication if they can reach the vulnerable component. The remaining 110 vulnerabilities range from medium to critical severity and cover a very broad set of weakness classes, including buffer overflows (stack, heap, over-read), use-after-free, type confusion, deserialization of untrusted data, SSRF, XSS, SQL injection, and improper signature verification, among others.

Exploitation of most of these flaws requires the attacker to convince a victim to open a malicious file or follow a malicious link — consistent with typical Office document/attachment-based attack chains rather than fully zero-click network exploitation, though this should be verified per-CVE via the MSRC portal. No in-the-wild exploitation is claimed in this advisory. Defenders should prioritize the four 9.8-rated RCE issues (Office, Outlook, Skype) for expedited patching given their unauthenticated exploitation potential, and roll out the broader monthly Office update set through standard patch management processes. Full technical details, affected build numbers, and any workarounds are available via the Microsoft Security Response Center (MSRC) portal referenced in the advisory.

This is a routine vendor patch bulletin aggregated by NCSC-NL rather than a report of active exploitation or a novel attack campaign; the primary action for defenders is timely deployment of the November/December 2026 Office security updates across Windows and Office deployments.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0352.html