EUVD-2026-100171
GHSA-qg8w-687j-6r9q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted email to target
-
DeliveryOutlook parses malicious message content
-
ExploitTrigger heap-based buffer overflow (CWE-122)
-
ExecutionExecute arbitrary code in Outlook context
-
ImpactFull compromise of user host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target run an affected Microsoft Office Outlook build (Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, or an unpatched Microsoft 365 Apps for Enterprise channel) and that the attacker be able to deliver a crafted message that Outlook processes. Per the CVSS vector there are no authentication or user-interaction prerequisites (PR:N/UI:N) against default configurations, so a crafted email reaching the victim's mailbox is sufficient. The primary limiting factor is patch state: Microsoft has released a fix, so patched installations are not exploitable; organizations should also verify whether automatic message preview/rendering is the trigger path, as disabling preview or using reading restrictions could reduce the automatic-processing surface. |
| Impact | This is a genuinely high-priority flaw by most signals, though exploitation is not yet observed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated, no-interaction heap overflow yielding full C:H/I:H/A:H impact, scoring 9.8 Critical - the worst-case RCE profile. CISA's SSVC framework reinforces part of this: Technical Impact is 'total' and the flaw is 'Automatable: yes', meaning reliable, scriptable mass exploitation is plausible once an exploit is developed. However, SSVC Exploitation is 'none' and the input provides no KEV listing and no POC, so there is currently no public exploit identified at time of analysis - the severity reflects potential, not active abuse. EPSS is NOT provided in the input, so probabilistic exploitation likelihood cannot be factored in and should be checked separately. One signal worth verifying: the vector asserts UI:N (no user interaction), yet historically many Outlook heap-overflow RCEs are triggered via the message preview/rendering path, which Microsoft often still classifies as UI:N - confirm with the MSRC advisory whether a specially crafted email is auto-processed or requires the victim to open it, as this materially changes real-world risk. |
| Exploit ScenarioDerived | A remote attacker sends a specially crafted email or message to a target; when Outlook parses the malicious content it overflows a heap buffer, corrupting memory and allowing the attacker to execute arbitrary code in the context of the Outlook process. Per the CVSS vector this requires no authentication and no user interaction (AV:N/AC:L/PR:N/UI:N), making it suitable for automated delivery. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Heap-based buffer overflow in Microsoft Outlook lets an unauthenticated remote attacker execute arbitrary code by getting a crafted message processed by a vulnerable client, with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWE-122 as the root-cause class. Affected builds are Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft Office LTSC 2021 before 16.0.14334.20974, and unpatched Microsoft 365 Apps for Enterprise channels; because the assessed vector carries PR:N/UI:N, delivery of a malicious message to the mailbox is sufficient under default configurations, with patch state as the main limiting factor. Vendor-released patch: available from Microsoft per the MSRC update guide; there is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' while flagging the flaw as automatable with total technical impact.
RemediationAI
Vendor-released patch: Microsoft has published fixes for this issue - update Office LTSC 2024 to 16.0.17932.21056 or later, Office LTSC 2021 to 16.0.14334.20974 or later, and Microsoft 365 Apps for Enterprise to the current Office security release published at https://aka.ms/OfficeSecurityReleases, following the per-build guidance in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70242; since Microsoft 365 Apps updates on a rolling channel, confirm the applied build number rather than assuming an update landed, and prioritize endpoints that process external mail automatically. Where patching cannot be completed immediately, reduce the automatic-processing surface that a crafted message can reach: disable the Outlook reading/preview pane and configure messages to be read in plain text, which prevents automatic rendering of rich content - the trade-off is loss of inline HTML formatting, images, and some usability for all users, and it may not fully close the attack path if the vulnerable code is reached through other message handling routes. Additional compensating controls include blocking or quarantining high-risk message content types and encapsulated objects at the mail gateway, and enforcing attachment-type restrictions, but these are evasion-prone filters rather than fixes and should only be regarded as temporary until the Office build is upgraded. Note that exploit code is not publicly available at time of analysis and no active exploitation has been confirmed, so remediation urgency is driven by the severity (CVSS 9.8, PR:N/UI:N, total technical impact per CISA SSVC) rather than by observed attacks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The underlying defect is a heap-based buffer overflow (CWE-122), a memory-safety class in which a write or copy operation exceeds the bounds of a heap-allocated buffer, corrupting adjacent heap metadata and structures, which in turn enables controlled memory corruption that can be steered toward code execution in the Outlook process context. The affected technology is Microsoft Outlook's message-processing pipeline, which parses attacker-supplied email content - body text, HTML/MIME parts, encapsulated objects, and attachments - and is reachable directly from network-delivered mail, matching the AV:N vector. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and the CISA SSVC attributes (Automatable: yes, Technical Impact: total) together describe a remotely triggerable, repeatable, high-impact memory-corruption bug requiring no prior credentials and no user interaction beyond receipt and processing of the message, which makes automatic processing paths such as message preview/rendering the relevant exposure surface. EUVD classifies the issue under EUVD-2026-100171, and the CPE/version data provided through the EUVD advisory binds the flaw to the Outlook code shipped inside the Office LTSC 2024, Office LTSC 2021, and Microsoft 365 Apps for Enterprise builds listed.
Know when Outlook gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-delivered crafted message triggers a heap overflow with no auth and no interaction per the described unauthorized remote RCE, giving full code execution and total CIA impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A critical heap-based buffer overflow in Microsoft Outlook allows an unauthenticated attacker to run arbitrary code on a workstation by sending a crafted email, with no user interaction required under the assessed vector. Because Outlook is deployed across essentially the entire workforce, every mailbox becomes a potential delivery path, and a single success could give an attacker a foothold on corporate endpoints with access to mail, credentials, and connected services. Microsoft has already shipped fixes, so this is a time-bound patching obligation leadership can close rather than an active incident to contain.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrar
A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in m
A library injection vulnerability exists in Microsoft Outlook 16.83.3 for macOS. Rated critical severity (CVSS 9.1), thi
Microsoft Outlook Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely ex
Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1
Microsoft Outlook 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 allows remote attackers to execute arbitrary code via a craf
A remote code execution vulnerability exists in the way Microsoft Office software parses specially crafted email message
Microsoft Outlook Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely ex
SpotOutlook 1.2.6 contains a denial of service vulnerability in the registration name input field that allows attackers
Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Mic
Exploit-DB