The number of patches -- nearly two dozen -- is higher than usual for an odd-numbered month; for some time, Microsoft has used an even-odd schedule, patching more vulnerabilities in the even months, when it also regularly updates Internet Explorer.
"May has been a light month, historically, very light," said Andrew Storms, director of security operations at nCircle Security, who tracks the number of patches and updates Microsoft issues each month.
In May 2011, Microsoft shipped two update that . The year before, it delivered two updates that patched two bugs.
"So, this is a big number," said Storms.
The pace so far this year -- Microsoft's collections during the first five months have included seven, nine, six, six and seven updates -- puts to rest the idea that Microsoft still hews to a wave-and-trough practice.
"Certainly for bulletin count, it looks like a pretty flat line to me," said Storms, using the term "bulletin" -- Microsoft's label -- to describe security updates. "This year, it looks like the up and down pattern has ended."
Wolfgang Kandek, CTO of Qualys, agreed with Storms.
"In prior years we have seen much stronger differences [in the number of updates each month], ranging from 2 to 17," Kandek said in an email. "We are not sure this [flattening] is intended, but it makes the workload much more predictable and is preferable to the more bursty release mode."
Of the seven updates, Microsoft tagged three as "critical," the highest threat ranking in its four-step system, and the other four as "important," the next-most serious score.
Four updates will address vulnerabilities in Windows; four will impact Office, Microsoft's popular application suite; and one will affect the Silverlight development framework. That count exceeds seven because one of updates tackles bugs in all three of those lines.
The large number of Office updates caught Storms' eye: Three of the pending bulletins are Office-only, while one is shared with Windows and Silverlight. The trio of Office-only updates will patch flaws in Word, Excel and Visio. The latter is a little-used commercial diagramming program that's considered part of the Office family.
"There's a heavy lean toward Office here," Storms noted.
Storms pointed his finger at what Microsoft labeled Bulletin 2 as the most likely to rise to the top of the to-do list next week. His reasons: It was pegged critical, impacts virtually every edition of Windows, applies to all currently-supported versions of Office on Windows and also patches one or more bugs in Silverlight.
Although today's for next week's Patch Tuesday was the usual bare-bones outline, Storms suspected that Bulletin 2 would fix bugs in the .Net development framework, which is included by default with Windows, and is also used by Office programmers.
".Net could be the common ground," Storms speculated.
Others, including Kandek and Marcus Carey of Rapid7, didn't call out a single update for special attention, but instead noted that the three critical bulletins, as well as two labeled important, should be patched as soon as possible next week.
Both updates rated important can result in what Microsoft calls "remote code execution" -- meaning attackers could hijack a PC if they successfully exploited the vulnerabilities -- and were aimed at Excel and Visio.
Two of the four Office updates will apply to the 2008 and 2011 editions of Office for Mac.
Storms also commented on Microsoft's apparent quickened bug-patching tempo so far this year. When next week's 23 are added to the mix, Microsoft will have issued 70 patches so far this year; the company had fixed only 59 flaws by the end of May 2011
Microsoft will release the seven updates at approximately 1 p.m. Eastern time on May 8.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at , or subscribe to . His e-mail address is .
in Computerworld's Security Topic Center.