Microsoft has released a security update for Office Web Apps Server 2013 as part of the MS14-081 security update from December 12, 2014.

The update resolves a security vulnerability that could allow arbitrary code to run when a maliciously modified file is opened.

Download the update (KB2889851) here.
More information about the update here.