Adobe, Microsoft Issue Critical Security Fixes
Summary: Adobe and Microsoft each released security fixes for dangerous flaws in their products, with Microsoft issuing seven bulletins covering at least eight Windows vulnerabilities and Adobe patching a zero-day in Acrobat and Reader. Microsoft's lone critical patch addresses a pair of bugs in Windows Media Player that attackers could trigger just by getting a user to browse to a site hosting specially crafted video content, while Symantec's Joshua Talbot called a separate Office-file handling flaw potentially more dangerous because it lets an attacker run malware as soon as a user opens a Word or PowerPoint file.
Why it matters: The Office flaw Talbot flagged is rated only 'important' by Microsoft yet runs malware the moment a user opens a Word or PowerPoint file, making email attachments the likely attack path - and Microsoft's Dec. 29 out-of-band ASP.Net update, which affects all .NET Framework versions on Windows XP and later, was reported by commenters as not always installing correctly.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026