Microsoft's latest zero-day patch blocks a viral Office document hack - how to protect your PC ASAP

Follow ZDNET: Add us as a preferred source on Google. Microsoft has issued an emergency patch designed to resolve a zero-day security vulnerability affecting several versions of Microsoft Office. Already exploited in the wild, the flaw could allow an attacker to skirt past Office's built-in security measures and send victims a malicious document. In a note published earlier this week, Microsoft revealed details behind the flaw, known as a Microsoft Office Security Feature Bypass Vulnerability. Also: Why you need Microsoft's new emergency Windows patch - and the black-screen bug to watch for Tagged as CVE-2026-21509, this vulnerability bypasses the OLE mitigations in Microsoft 365 and Microsoft Office. OLE (Object Linking and Embedding) lets Office link to or embed files, text, images, and other content from external applications. The OLE mitigations are supposed to prevent hackers from exploiting these controls to send malicious files and documents. Attackers take advantage of such vulnerabilities to launch phishing campaigns in which you're prompted to open a malicious file attachment. With the built-in security not working properly, the malicious code in the file can then easily infect your system. Various versions of Microsoft 365 and Office are affected, including Microsoft Office 2016 (32-bit), Microsoft Office 2019 (32-bit and 64-bit), Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office LTSC 2021 (32-bit and 64-bit), and Microsoft Office LTSC 2024 (3...