EUVD-2026-99710
GHSA-7462-8hg2-qwc4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted email to victim
-
DeliveryVictim opens or previews message
-
ExploitTrigger heap buffer overflow in parser
-
ExecutionExecute arbitrary code as user
-
ImpactCompromise mailbox and host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim running Microsoft Outlook (Microsoft 365 Apps for Enterprise, Office LTSC 2024 before 16.0.17932.21056, or Office LTSC 2021 before 16.0.14334.20974) to open or preview an attacker-supplied malicious email or attachment - the UI:R metric confirms this victim interaction is mandatory, which is the primary limiting factor since an unauthenticated remote attacker cannot trigger the overflow without the user rendering the crafted content. No special non-default configuration or attacker authentication is required (PR:N), and code executes in the context of the interacting user rather than SYSTEM (S:U). Patched builds are available from the vendor and eliminate the condition. |
| Impact | This is a genuinely high-priority vulnerability, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated heap overflow (CWE-122) yielding full confidentiality, integrity, and availability impact - classic remote code execution potential in Outlook. The single mitigating factor in the vector is UI:R (user interaction required), meaning a victim must open or preview a malicious message/attachment. Signals partially conflict on urgency: SSVC reports Exploitation=none and Automatable=no, and there is no CISA KEV listing and no POC in the provided data, so exploitation probability is currently low - no EPSS score was supplied to quantify this. SSVC Technical Impact=total aligns with the C:H/I:H/A:H impact. Net: a high-impact, broadly exploitable bug in extremely widely deployed software with a patch available, but no evidence of current exploitation - patch promptly rather than treat as actively-weaponized. Note: EPSS score is absent from the input, so real-world exploitation likelihood cannot be numerically confirmed; the 'no public exploit' status may change quickly for a product this prevalent. |
| Exploit ScenarioDerived | An attacker crafts a malicious email or attachment that, when opened or rendered in the preview pane by a victim, triggers a heap-based buffer overflow in Outlook's parsing code and executes arbitrary code in the user's context. No authentication is required of the attacker, but the victim must interact with the message (UI:R). No public proof-of-concept exploit was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Heap-based buffer overflow in Microsoft Outlook lets an unauthenticated remote attacker execute arbitrary code in the context of the user who opens or previews a specially crafted email or attachment, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2024 before 16.0.17932.21056, and Office LTSC 2021 before 16.0.14334.20974. Exploitation is gated by mandatory victim interaction (UI:R) and code runs at the interacting user's privilege level rather than SYSTEM (S:U), so it is a high-priority but not emergency-level issue. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as none with total technical impact; vendor-released patches are available. Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (CVSS 8.8); CWE-122; EUVD-2026-99710.
RemediationAI
Vendor-released patch: update to Microsoft Office LTSC 2024 16.0.17932.21056 or later and Office LTSC 2021 16.0.14334.20974 or later, or apply the current Microsoft 365 Apps for Enterprise channel release listed at https://aka.ms/OfficeSecurityReleases; full per-build guidance is in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70257 (referenced from NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70257). Until patched clients are fully deployed, the most effective compensating control is to strip or block untrusted rich message content and attachments at the mail gateway and to disable the automatic reading-pane preview so messages must be deliberately opened - trade-offs are loss of inline preview convenience and potential filtering false positives that delay legitimate mail. Forcing Outlook to render mail as plain text removes the risky parsing surface but degrades formatting, images, and link behavior for all users. Ensuring users run Outlook as standard users (not local administrators) limits post-exploitation reach given the S:U scope, though it does not prevent the overflow itself, and treating mail-rendering clients as untrusted execution environments with EDR coverage adds detection without blocking the attack path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a heap-based buffer overflow (CWE-122) in how Microsoft Outlook parses crafted content delivered over the network, resulting in memory corruption that can be steered into arbitrary code execution. Because the CVSS vector carries PR:N, no attacker authentication or prior access is required, but the UI:R metric confirms the victim must render the malicious message or attachment, and S:U means the overflow executes only within the privileges of the interacting Outlook user rather than escalating to SYSTEM, which constrains the blast radius per victim. CISA's SSVC decision data (Exploitation: none, Automatable: no, Technical Impact: total) corroborates that this is a memory-safety flaw requiring human-driven interaction rather than a self-propagating or wormable condition. The affected code path lives in the Outlook client engine shared across the Microsoft 365 Apps for Enterprise, Office LTSC 2024, and Office LTSC 2021 channels, all of which ship the 16.0.x build lineage tracked under the vendor's Office security release and version-range data.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered email with no attacker auth (AV:N/PR:N), but victim must open/preview content (UI:R); heap RCE in user context gives full C/I/A and S:U.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Outlook users across the organization face a high-severity remote code execution risk from a heap overflow that triggers when a user opens or previews a specially crafted email or attachment, potentially allowing an attacker to run code with the victim's privileges. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2024, and Office LTSC 2021, and while no public exploit code has been identified, the combination of unauthenticated network access and required user interaction makes phishing-style attacks a realistic path to compromise user accounts and sensitive data. Leadership should prioritize patching because successful exploitation could lead to data theft or further lateral movement within the enterprise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB