Microsoft Outlook and Word Remote Code Execution Vulnerability

In plain English

Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally. Affected products named by the advisory: Microsoft SharePoint Enterprise Server 2016; Microsoft SharePoint Server 2019; Microsoft SharePoint Server Subscription Edition. Successful exploitation can let an attacker run code in the security context of the affected service or device.

Vulnerable items

• Microsoft SharePoint Enterprise Server 2016 — Microsoft SharePoint Enterprise Server 2016 is a Microsoft Server server component identified as affected by the official advisory.
• Microsoft SharePoint Server 2019 — Microsoft SharePoint Server 2019 is a Microsoft Server server component identified as affected by the official advisory.
• Microsoft SharePoint Server Subscription Edition — Microsoft SharePoint Server Subscription Edition is a Microsoft Server server component identified as affected by the official advisory.

Recommended action

Primary action: update to a vendor-listed fixed release: 16.110.26061317, 16.0.5556.1005, 16.0.10417.20153, 16.0.19725.20384, 16.0.5556.1000.