In most cases exploitation would require an attacker to send a specially crafted file, such as a malicious document, and persuade the recipient to open it. Buffer overflows account for most of the RCE flaws, with others stemming from off-by-one, use-after-free, path traversal and numeric truncation errors.

Word received the majority of the patches, with only a few each for Excel, Outlook, PowerPoint and SharePoint. Beyond the RCE bugs, Microsoft also fixed multiple information disclosure issues and a security bypass in Office.

The release also covers a denial-of-service defect in ASP.NET Core, an elevation of privilege flaw in Identity Web, and an information disclosure bug in the Authentication Library (MSAL) for Node.js. Microsoft says none of the newly resolved issues have been exploited in the wild as a zero-day. The patches arrived days after the company's record Patch Tuesday rollout, and Microsoft also updated advisories from 13 October to note that fixes are now available for Office LTSC for Mac 2021 and 2024 and Office 365 for Mac.