Security News > 2022 > January > Microsoft fixes critical Office bug, delays macOS security updates
During this year's first Patch Tuesday, Microsoft has addressed a critical severity Office vulnerability that can let attackers execute malicious code remotely on vulnerable systems.
The security flaw, tracked as CVE-2022-21840, is a remote code execution bug that attackers can exploit with no privileges on the targeted devices as part of low complexity attacks that require user interaction.
Even though Redmond has released security updates for Microsoft 365 Apps for Enterprise and Windows versions of Microsoft Office, the company is still working on patches addressing the vulnerability on macOS. Mac users running Microsoft Office LTSC for Mac 2021 and Microsoft Office 2019 for Mac were told they would have to wait a little more to get CVE-2022-21840 patches.
"The security update for Microsoft Office 2019 for Mac and Microsoft Office LTSC for Mac 2021 are not immediately available," Microsoft says in today's security advisory.
Microsoft has also failed to promptly release macOS patches for an actively exploited Excel zero-day in November, a severe security feature bypass bug that allows local exploitation from unauthenticated attackers in low complexity attacks that don't require user interaction.
According to updates to the CVE info, Redmond issued security updates for the Microsoft Office for Mac zero-day one week later, advising users to deploy the patches for their product to be protected from in the wild attacks.
News URL
Related news
- 89% of Enterprise GenAI Usage Is Invisible to Organizations Exposing Critical Security Risks, New Report Reveals (source)
- URGENT: Microsoft Patches 57 Security Flaws, Including 6 Actively Exploited Zero-Days (source)
- Patch Tuesday: Microsoft Fixes 57 Security Flaws – Including Active Zero-Days (source)
- Stealthy Apache Tomcat Critical Exploit Bypasses Security Filters: Are You at Risk? (source)
- AI agents swarm Microsoft Security Copilot (source)
- After Detecting 30B Phishing Attempts, Microsoft Adds Even More AI to Its Security Copilot (source)
- Microsoft: New Windows scheduled task will launch Office apps faster (source)
- Android Malware Exploits a Microsoft-Related Security Blind Spot to Avoid Detection (source)
- Week in review: Chrome sandbox escape 0-day fixed, Microsoft adds new AI agents to Security Copilot (source)
- Apple Backports Critical Fixes for 3 Recent 0-Days Impacting Older iOS and macOS Devices (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-01-11 | CVE-2022-21840 | Unspecified vulnerability in Microsoft products Microsoft Office Remote Code Execution Vulnerability | 8.8 |