Microsoft Outlook CVE-2026-108448

Exploitation requires a victim to open or preview an attacker-supplied crafted email message or Office document inside Outlook (UI:R) - it is not a zero-click flaw against default configurations. No authentication on the target is required (PR:N), and the vector is network-delivered (AV:N). Limiting factors: the high attack complexity (AC:H) indicates the attacker must satisfy conditions outside their control - typically reliable heap grooming and memory-layout control to turn the CWE-122 heap overflow into code execution - and the mandatory user interaction. Affected deployments are the Click-to-Run/LTSC Office builds on Windows and macOS listed in the CPEs; a patch is available from Microsoft, so patched installations are not exposed.

This is a genuine but not top-tier priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5 HIGH) shows a network-reachable, unauthenticated flaw with full triad impact, which raises concern - but two metrics temper it materially: AC:H means successful exploitation depends on conditions outside the attacker's control (typical of heap-overflow memory-corruption that requires reliable heap grooming/ASLR defeat), and UI:R means a user must open or preview a malicious message or document. The vendor confirms a patch is available. No exploitation-probability signals are present: EPSS is NOT provided, this CVE is NOT on CISA KEV, and no POC is referenced - the only reference is the Microsoft MSRC advisory. So exploitation status is 'no public exploit identified at time of analysis.' Net: a CRITICAL-looking impact profile dampened by high attack complexity and required user interaction, affecting a near-ubiquitous product. Prioritize patching because the installed base is enormous and memory-corruption bugs in Office/Outlook are historically weaponized, but there is currently no evidence of active or imminent exploitation. Note the data gap explicitly: EPSS is absent, so probabilistic exploitation likelihood cannot be quantified from the provided inputs.

An attacker emails a victim a specially crafted message or attachment that, when opened or rendered in Outlook, triggers a heap-based buffer overflow (CWE-122) and corrupts memory to execute attacker-controlled code in the user's context. No credentials are needed on the target side, but the victim must interact with the content, and the high attack complexity means the attacker needs reliable control over heap layout to achieve code execution. No public proof-of-concept or exploit code is identified at time of analysis.