Microsoft today issued 26 CVEs for some 115 total vulnerabilities in a relatively hefty Patch Tuesday that includes 26 critical flaws that span browsers, Microsoft Word, and Media Foundation.

The critical flaws break down to 17 in browser and scripting engines, four in Media Foundation, two in GDI+, one in LNK files, one in Microsoft Word, and one in Dynamic Business. Among the more notable patches are ones for a remote code execution (RCE) flaw in Microsoft Word (CVE-2020-0852), which can be exploited via the Outlook Preview Pane and without even opening a Word file, according to Recorded Future. 

Microsoft also patched three other remote code execution flaws in Word (CVE-2020-8050, CVE-2020-8051, and CVE-2020-8055), which could be exploited via a malicious Word file or website.

"As Recorded Future has previously noted, Microsoft Office is among the most popular attack vectors for cybercriminals. We expect one or more of these vulnerabilities will be weaponized sooner rather than later," said Allan Liska, intelligence analyst at Recorded Future.

Qualys, meantime, recommends prioritizing the patching of a RCE in Application Inspector (CVE-2020-0872), which is rated as "important" by Microsoft.

"The Scripting Engine, LNK files (CVE-2020-0684), GDI+(CVE-2020-0831, CVE-2020-0883) and Media Foundation (CVE-2020-0801, CVE-2020-0809, CVE-2020-0807, CVE-2020-0869) patches should be prioritized for workstation-type devices, meaning any system that is used for email or to access the internet via a browser," said Animesh Jain, a vulnerability management research team expert at Qualys. "This includes multi-user servers that are used as remote desktops for users."

Read more here. 

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "Keys to Hiring Cybersecurity Pros When Certification Can't Help."