XPost: alt.comp.os.windows-10   
   From: G6JPG@255soft.uk   
      
   On 2026/1/28 6:42:31, ...w¡ñ§±¤ñ wrote:   
   > Mr. Man-wai Chang wrote on 1/27/2026 10:51 PM:   
   >> Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for   
   >> Active Exploitation   
   >>    
   >>   
   >>   
   >> Microsoft on Monday issued out-of-band security patches for a   
   >> high-severity Microsoft Office zero-day vulnerability exploited in attacks.   
      
   Do we have a KB number (or isn't that a valid question these days)?   
   >>   
   >> The vulnerability, tracked as CVE-2026-21509, carries a CVSS score of 7.8   
   >> out of 10.0. It has been described as a security feature bypass in   
   >> Microsoft Office.   
   >>   
   >> "Reliance on untrusted inputs in a security decision in Microsoft Office   
   >> allows an unauthorized attacker to bypass a security feature locally,"   
   >> the tech giant said in an advisory.   
   >>   
   >> "This update addresses a vulnerability that bypasses OLE mitigations in   
   >> Microsoft 365 and Microsoft Office, which protect users from vulnerable   
   >> COM/OLE controls."   
      
   Are earlier versions (e. g. 2003, 2007) vulnerable?   
   >>   
   >> Successful exploitation of the flaw relies on an attacker sending a   
   >> specially crafted Office file and convincing recipients to open it. It   
   >> also noted that the Preview Pane is not an attack vector.   
   >>   
   Would that file be .docx (or whatever)?   
   []   
      
   --   
   J. P. Gilliver. UMRA: 1960/<1985 MB++G()ALIS-Ch++(p)Ar++T+H+Sh0!:`)DNAf   
      
   "Scheisse," said Pooh, trying out his German.   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)