EUVD-2026-99717
GHSA-58m6-fvhq-5883
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious email with malformed structure
-
DeliveryDeliver email to target Outlook mailbox
-
ExploitOutlook parses content and overflows heap buffer
-
ExecutionCorrupt heap to hijack control flow
-
ImpactExecute arbitrary code in user context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target to receive and have Outlook process a crafted email message that triggers the heap-based buffer overflow during parsing/rendering; affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the macOS Outlook/Office builds (Office LTSC for Mac 2021/2024, Office 365 for Mac). The CVSS vector asserts no privileges and no user interaction (PR:N/UI:N), implying a preview-pane/zero-click trigger against default configurations rather than requiring the user to open or click the message. Limiting factors: exploitation is bounded to installations running unpatched vulnerable builds, and SSVC currently reports Exploitation: none, so no active or public exploitation is occurring at time of analysis; if Microsoft's advisory in fact requires the user to open the message, the UI:N claim overstates reach. |
| Impact | This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated code execution with total CIA impact (C:H/I:H/A:H), yielding a 9.8 Critical. CISA's SSVC framework reinforces this: Technical Impact is 'total' and the flaw is 'Automatable: yes', meaning an attacker could reliably script delivery and triggering at scale. However, the signals are not uniformly alarming - SSVC Exploitation is 'none', and there is no CISA KEV listing and no public POC, so there is no public exploit identified at time of analysis and no evidence of in-the-wild use yet. EPSS was not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Note one tension to verify: the vector asserts UI:N (zero interaction), which for an email client typically implies a preview-pane/zero-click trigger; if exploitation in fact requires the victim to open a crafted message, real-world risk is marginally lower than the raw 9.8 suggests - verify the interaction requirement with Microsoft's MSRC advisory. Given ubiquitous deployment, a vendor patch is already available, and 'Automatable: yes' with 'total' impact, this should be prioritized for prompt patching even absent current exploitation. |
| Exploit ScenarioDerived | An attacker sends a specially crafted email whose malformed content triggers a heap-based buffer overflow in Outlook's message parsing, corrupting heap memory to achieve arbitrary code execution in the victim's Outlook process. Because the CVSS vector specifies UI:N, this may trigger on message preview/rendering without the user clicking anything. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Heap-based buffer overflow in Microsoft Outlook allows an unauthenticated remote attacker to execute code over a network by delivering a crafted email message that Outlook processes during parsing or rendering. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) asserts no privileges and no user interaction, implying a zero-click/preview-pane trigger against default configurations; the impact is scoped to installations running the vulnerable builds of Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 365 for Mac, and Office LTSC for Mac 2021/2024. CISA's SSVC assessment reports Exploitation: none and no public exploit code has been identified at time of analysis, but the issue is rated Automatable: yes with Technical Impact: total, and a vendor patch is available - this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-real-risk case.
RemediationAI
Apply the vendor patch: Microsoft rates the fix as available and directs customers to the MSRC Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70291, with Microsoft 365 Apps for Enterprise (and Office 365 for Mac) updated through the Office Security Releases channel at https://aka.ms/OfficeSecurityReleases, Office LTSC 2021 requiring build 16.0.14334.20974 or later, Office LTSC 2024 requiring build 16.0.17932.21056 or later, and the macOS LTSC builds requiring the corresponding published updates - verify actual installed build numbers after updating, since Microsoft 365 Apps will not upgrade until the update channel is refreshed. Until patching completes, the most effective compensating control is to force Outlook to render mail as plain text (Trust Center > Email Security > 'Read all standard mail in plain text'), which removes the rich HTML/RTF rendering path that feeds the overflow; the trade-off is loss of formatting, images, and reliable rendering of legitimate HTML mail, and it may break workflows that depend on rendered content. An alternative/complementary control is to quarantine or strip inbound HTML and RTF message bodies at the mail gateway, but this degrades legitimate mail and cannot be applied selectively to internal or direct-to-client delivery paths. Disabling the Outlook reading/preview pane is NOT a reliable mitigation here because the assessed vector (PR:N/UI:N) indicates the trigger does not depend on user interaction, and treating it as such would give a false sense of safety; defense-in-depth adjustments such as keeping Office/Windows fully patched, enforcing exploit protection (ASLR, CFG, DEP), and maintaining EDR coverage on Outlook processes are reasonable supplements but do not close the flaw. Note that SSVC currently reports Exploitation: none and no public exploit code has been identified, so emergency out-of-band action is driven by the 9.8 severity and the Automatable/Total-impact rating rather than by observed exploitation; nevertheless, given that exploitation is automatable over email, prioritize internet-facing mail hygiene, Exchange/Defender for Office 365 detonation and filtering, and rapid client patching over the typical monthly cycle.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a heap-based buffer overflow (CWE-122): Outlook fails to correctly bound memory allocation while handling attacker-controlled content within an inbound email message, so an out-of-bounds write corrupts adjacent heap structures. Successful corruption of heap metadata or adjacent objects in the process address space can be leveraged to redirect execution flow and run attacker-supplied code with the privileges of the Outlook process. The vulnerable surface is Outlook's message parsing/rendering pipeline rather than a network service, which is why the attack is delivered as an email message; because the assessed vector specifies PR:N/UI:N, the trigger is expected to occur when Outlook processes the message content rather than requiring the recipient to click a link or explicitly open an attachment, though if Microsoft's advisory in fact requires the user to open the message the UI:N claim overstates reach. The affected build set spans the Windows desktop clients (Microsoft 365 Apps for Enterprise, Office LTSC 2021 build <16.0.14334.20974, Office LTSC 2024 build <16.0.17932.21056) and the macOS clients (Office 365 for Mac, Office LTSC for Mac 2021 and 2024), meaning the fix must be tracked per-channel because they receive updates through different mechanisms. The buffer overflow class is memory-safety, so mitigations such as ASLR, CFG, and the Office sandbox/Protected View can raise exploitation difficulty but are not a substitute for patching.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-delivered email parsing overflow with no auth yields AV:N/AC:L/PR:N and full C/I/A; UI:N retained per vendor's zero-click/preview assertion, though UI:R is plausible if opening is required.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A critical vulnerability in Microsoft Outlook allows an unauthenticated attacker to execute code remotely by sending a crafted email, potentially compromising affected systems without any user interaction. Organizations using Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, or Office for Mac are at risk, and a successful exploit could lead to data theft, ransomware, or full network compromise. Leadership should prioritize immediate patching because this affects a core business application with a broad attack surface.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB