On Monday attackers released three Office zero-day exploits on security forum, security vendor McAfee reported on a
company blog. While two of the reported flaws merely result in an application crash, the third one looks more serious. It "might be exploited for code execution", wrote Karthik Raman, a McAfee researcher.
The fourth reported vulnerability affects the way that Windows handles .hlp files. It too "might" be used to executive arbitrary code that allows attackers to gain control of a system.
Microsoft has listed .hlp files as "unsafe" because they are executable. The format is has features similar to those of .exe files
The software vendor added that it isn't aware of any attacks targeting the new vulnerabilities.
Details of the flaws were released around Microsoft's Patch Tuesday, the second Tuesday of the month when the company issues new software updates. McAfee's Raman suggested that the timing could maximise the period that the public is exposed to the flaw before next month's patch release.
Microsoft however will issue so-called out of band patches whenever a vulnerability attracts wide-spread attacks.