Microsoft Office Remote Code Execution Vulnerability

In plain English

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. Affected products named by the advisory: Microsoft SharePoint Enterprise Server 2016; Microsoft SharePoint Server 2019; Microsoft SharePoint Server Subscription Edition. Successful exploitation can let an attacker run code in the security context of the affected service or device.

Vulnerable items

• Microsoft SharePoint Enterprise Server 2016 — Microsoft SharePoint Enterprise Server 2016 is a Microsoft Server server component identified as affected by the official advisory.
• Microsoft SharePoint Server 2019 — Microsoft SharePoint Server 2019 is a Microsoft Server server component identified as affected by the official advisory.
• Microsoft SharePoint Server Subscription Edition — Microsoft SharePoint Server Subscription Edition is a Microsoft Server server component identified as affected by the official advisory.

Recommended action

Primary action: update to a vendor-listed fixed release: 16.0.5556.1005, 16.110.26061317, 16.0.10417.20153, 16.0.19725.20384.