This Microsoft Patch Tuesday, among with the historical 974 (!) bugs patched, I contributed three. - Microsoft Word Remote Code Execution Vulnerability (CVE-2026-78510) * https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78510 - Microsoft Office Outlook Remote Code Execution Vulnerability (CVE-2026-78509) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78509 - Microsoft Office Word Remote Code Execution Vulnerability (CVE-2026-78507) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78507 For me, the most notable one is the CVE-2026-78510, the Microsoft Security Update Guide page's title is quite misleading as it didn't even say it affects Outlook. In fact, it's a zero-click RCE (or someone like to call it "half-click") on Microsoft Outlook affecting the Preview Pane, means the bug could be triggered as long as the user previews or opens the email on Outlook. I'm communicating with MSRC to hopefully address the misleading webpage. I recommend patching it sooner rather than later. Btw, if you're worrying about potential Outlook zero-click/half-click 0day attacks, I've put significant efforts in my @EXPMON_ system (https://pub.expmon.com) where it should be good at detecting such advanced attacks. It accepts email formats (.msg, .eml) and it checks deeply for various attack vectors! #PatchTuesday #OfficeSecurity #Outlook #zeroday #0day #EmailSecurity
Post summary
The tweet announces three new Microsoft Office/Outlook CVEs, details a zero‑click RCE in Outlook's preview pane, urges users to apply the patches, and mentions a detection system for such attacks.
