EUVD-2026-99705
GHSA-c3f5-3j68-qpcf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted email to Outlook user
-
DeliveryVictim opens or renders message
-
ExploitTrigger heap buffer overflow in parser
-
ExecutionExecute arbitrary code as user
-
ImpactCompromise mailbox and endpoint
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to deliver a specially crafted email item to a user running an affected Microsoft Outlook build (Microsoft 365 Apps for Enterprise, or Office LTSC 2024 before 16.0.17932.21056) and requires that user to open or render the malicious item (CVSS UI:R) - it is not zero-click or self-propagating. No authentication is needed on the target (PR:N), and code runs in the context of the logged-on user rather than with elevated privileges (S:U), so the practical blast radius is that user's session. Limiting factors: the mandatory user interaction, the need for the victim to be on an unpatched version, and the user-level (non-admin) execution context reduce realistic risk below that of a zero-click flaw. |
| Impact | This is a credible high-priority issue but not a confirmed emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes network-reachable, unauthenticated, low-complexity code execution against Microsoft Outlook with total confidentiality, integrity, and availability impact (C:H/I:H/A:H), yielding a base score of 8.8. Critically, every exploitation signal is currently cold: CISA SSVC lists Exploitation as 'none' and Automatable as 'no', there is no CISA KEV listing, and no public exploit code is referenced in the provided data - so this is a high-CVSS issue without evidence of active exploitation. The one strong counterweight is product reach: Outlook is deployed almost everywhere, and historically email-triggered Outlook memory-corruption bugs attract rapid attacker interest once a patch reverse-engineering target exists. The required user interaction (UI:R) meaningfully lowers automatability versus a true zero-click flaw, consistent with SSVC's 'Automatable: no'. Net: patch promptly given the ubiquity and total technical impact, but treat 'actively exploited' claims as unproven - no public exploit identified at time of analysis. |
| Exploit ScenarioDerived | An attacker emails a victim a message or attachment crafted to trigger a heap-based buffer overflow (CWE-122) in Outlook's parsing code. When the user opens or renders the item, the overflow corrupts heap memory and allows arbitrary code execution in the user's context. No public exploit code is identified at time of analysis, and user interaction is required, so delivery depends on social engineering rather than fully automated mass exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Heap-based buffer overflow in Microsoft Outlook allows remote code execution in the context of the logged-on user when a victim opens or renders a specially crafted email item. Affected builds are Microsoft 365 Apps for Enterprise and Microsoft Office LTSC 2024 prior to 16.0.17932.21056; the flaw is network-reachable and requires no authentication on the target (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, rated 8.8, CWE-122). CISA's SSVC assessment records no observed exploitation and non-automatable delivery, and no public exploit code has been identified at time of analysis, so this is a credible high-priority patching item rather than a confirmed emergency - mitigated in practice by mandatory user interaction and user-level (non-admin) execution context.
RemediationAI
Vendor-released patch: apply the Microsoft Office update that brings Office LTSC 2024 to version 16.0.17932.21056 or later, and for Microsoft 365 Apps for Enterprise install the current channel build listed in the MSRC Security Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70256) with the release matrix at https://aka.ms/OfficeSecurityReleases. Because exploitation requires the user to open or render the malicious item, interim risk reduction is achievable by reading untrusted mail in plain text (Outlook's 'Read all standard mail in plain text' option) and disabling the Reading Pane, which blocks rendering of the HTML/RTF rich content that carries the parsing path - the trade-off is loss of inline formatting, images, and link previews for all users, so scope it to high-risk populations rather than globally. Additional compensating measures with fewer side effects include enforcing Mark-of-the-Web/Protected View for mail attachments and blocking external senders from reaching users who do not expect them; disabling preview alone is not a substitute for the patch, and there is no configuration flag that removes the vulnerable parser. Since SSVC records no exploitation and delivery is non-automatable, patching can follow a normal prioritized cycle (Outlook users first) rather than an emergency break-fix, but the update should be verified in place, since stale pinned builds of LTSC 2024 are the most likely to remain exposed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a heap-based buffer overflow (CWE-122): Outlook writes more data into a heap-allocated buffer than it can hold while parsing content from a crafted mail item, corrupting adjacent heap metadata and enabling attacker-controlled memory corruption that Microsoft rates as high impact for confidentiality, integrity, and availability. The CVSS vector places this in the classic Office document-rendering class - AV:N (item delivered over the network, e.g. email), AC:L, PR:N (no credentials required on the victim), UI:R (the recipient must open or view the message), S:U (the exploit stays within the user's security scope), with all three CIA impacts rated High. Affected CPE/product data identifies Microsoft 365 Apps for Enterprise 16.0.1 and Microsoft Office LTSC 2024 16.0.0 below 16.0.17932.21056. Heap overflows of this type historically yield reliable code execution in Office because the parser operates on attacker-influenced input under a predictable allocator, though reliability depends on the specific build and mitigations present.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Email-delivered memory corruption is network-reachable (AV:N) and unauthenticated (PR:N) but needs the victim to open the item (UI:R), yielding code execution as that user (S:U, C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Outlook users in your organization are exposed to a high-severity remote code execution vulnerability (CVE-2026-70256) that could allow an attacker to take control of user accounts and access sensitive data when a specially crafted email is opened. Although no public exploit identified at time of analysis, the widespread use of Microsoft 365 Apps for Enterprise and Office LTSC 2024 means a successful attack could disrupt business operations and lead to data loss. Leadership should treat this as a priority patching item to protect organizational assets and maintain user trust.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB