The following security updates have been released. Office 2013 requires Service Pack 1 for Microsoft Office 2013 to be installed. Office 2016: Description of the security update for Office 2016: Novem(KB4486670) – closes the RCE vulnerabilitiy CVE-2021-42292 (Excel security bypass).

Office 2016: Description of the security update for Office 2016: Novem(KB5002032) – closes the RCE vulnerabilitiy CVE-2021-41368 in Microsoft Access.Excel 2016: Description of the security update for Excel 2016: Novem(KB5002056) – closes the vulnerabilities CVE-2021-40442 and CVE-2021-42292 (Remote Execution und Security Bypass).The following security updates have been released for Office 2016. Microsoft notes that patches for Office for Mac are still in the works. This means that the victim would have to open a malicious Excel document to exploit the vulnerability. However, Microsoft states that the display in the preview window is not an attack vector for this vulnerability. Microsoft warns that this vulnerability is being exploited in the wild. CVE-2021-42292 is a zero-day security bypass vulnerability in Microsoft Excel that has a CVSSv3 score of 7.8. Microsoft Excel vulnerabilities CVE-2021-40442 and CVE-2021-42292 are patched. Office 2019 does not appear in the list because it is distributed via click-to-run packages and receives security updates via the Office Update feature. Details are documented in the linked KB articles. An overview of the updates can be found on this web page (and here for November). The updates apply to the installable MSI version of Office (the click-to-run packages get the updates through other channels).

Microsoft office updates november 2019