EUVD-2026-99728
GHSA-pxgg-c4xh-w6pg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted email to target
-
DeliveryOutlook parses malformed message content
-
ExploitOverflow fixed-size stack buffer
-
ExecutionHijack return address, execute code
-
ImpactFull compromise of user context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The description identifies no special feature, protocol, or non-default configuration prerequisite - it states an unauthorized attacker can execute code over a network against Microsoft Office Outlook, consistent with AV:N/PR:N/UI:N (remote, unauthenticated, no interaction claimed). The realistic prerequisite is that the target's Outlook must receive and process an attacker-supplied message, so exploitation depends on message delivery reaching the victim's mailbox/client and on the vulnerable Office build being installed (notably Office LTSC 2024 <16.0.17932.21056, Office LTSC 2021 <16.0.14334.20974, plus Microsoft 365 Apps and the Mac Office editions listed in EUVD). The main limiting factor to verify is whether automatic preview truly triggers the parse (UI:N) or whether the user must open the message; if the latter, user interaction materially constrains exploitation. |
| Impact | Signals conflict in an informative way. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a worst-case profile: remote, low-complexity, unauthenticated code execution with total CIA impact, reinforced by SSVC Technical Impact of 'total' and Automatable 'yes'. However, SSVC Exploitation is 'none', there is no CISA KEV listing, and no public exploit code is identified - so there is no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be weighed. The net picture is a genuinely high-priority flaw on paper (ubiquitous client, network RCE, automatable) but with no current evidence of exploitation, placing it in the 'patch urgently, but not yet actively weaponized' tier. One tension to verify: the CVSS asserts UI:N (no user interaction), yet Outlook code-execution flaws are frequently email-borne and preview-pane/open-triggered; if Microsoft's advisory in fact requires a user to open or preview a message, real-world exploitability is lower than UI:N implies - verify UI requirement against the MSRC advisory. |
| Exploit ScenarioDerived | An attacker sends a specially crafted email or message payload to an Outlook user; when Outlook processes the malformed content, an oversized field overflows a fixed-size stack buffer and overwrites the return address, redirecting execution to attacker-controlled code that runs in the context of the Outlook process. Per the CVSS AV:N/AC:L/PR:N/UI:N vector this is a low-complexity, network-reachable, unauthenticated path, though no public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Remote code execution affects Microsoft Outlook through a stack-based buffer overflow (CWE-121) that a remote attacker can trigger by delivering attacker-controlled content to the victim's Outlook client, with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicating an unauthenticated, no-interaction attack and a maximum impact rating of 9.8 (C:H/I:H/A:H). Impact is total: successful exploitation corrupts stack memory in the Outlook process and can yield code execution in the context of the logged-on user, including full read/write access to mail data and the ability to pivot on the endpoint. No public exploit identified at time of analysis - CISA's SSVC assessment records Exploitation as "none" while rating the attack Automatable (yes) and Technical Impact as total, meaning scalable exploitation is technically feasible once exploit code is developed; patched builds are listed by the vendor for the Windows LTSC lines while several Mac and subscription builds are still tied to pending publication.
RemediationAI
Patch status: Patch available per vendor advisory. For Microsoft Office LTSC 2024, upgrade to 16.0.17932.21056 or later, and for Microsoft Office LTSC 2021, upgrade to 16.0.14334.20974 or later - these are the exact fixed builds published in the vendor/EUVD data and are the primary remediation for the Windows LTSC lines. For Microsoft 365 Apps for Enterprise, apply the current release from the Office security release channel at https://aka.ms/OfficeSecurityReleases, since that channel is continuously serviced and carries no single fixed build number; confirm the applied build post-update. For Microsoft Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024, the fixed versions are listed only as "<publication" in the available data, meaning a patched Mac build was not confirmed at time of analysis - check the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88156 for the published Mac build and apply it as soon as it appears. Until every affected client is updated, treat inbound mail as hostile: enforce server-side or gateway content inspection and attachment/message sanitization so malformed structures never reach the Outlook parser, accepting the trade-off of occasional false positives and quarantine delays on legitimate mail. Because the assessed vector is PR:N/UI:N, do not rely on user awareness alone; the only durable mitigation is removing the vulnerable parser from the exposure path by patching. If a Mac fleet cannot be patched while the build is pending, restrict those clients to webmail or a hardened alternative client, accepting the loss of native Outlook features, and segment them so a compromise cannot reach privileged mail data. Note that disabling the preview pane is a weak control at best and only helps if the trigger actually requires message rendering/open - which the independent assessment specifically flags as unverified - so it should not be counted as a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-121, a stack-based buffer overflow, which in the Outlook context means a fixed-size stack buffer is written past its bounds while processing malformed attacker-supplied message content (headers, body, or embedded structures), overwriting adjacent stack memory including saved return addresses and control data. Because the corrupted memory is within the Outlook process, a successful overwrite can redirect execution into attacker-chosen data and achieve arbitrary code execution under the privileges of the victim's Outlook session rather than requiring any prior authentication. CWE-121 is a classic memory-safety failure typically introduced when input length or content is not validated before a copy into a stack-allocated buffer; the vendor's tags (Buffer Overflow, Stack Overflow, Microsoft) are consistent with this classification. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U profile indicates the vulnerable code is reachable over a network with low attack complexity, no privileges, and scope unchanged (impact confined to the Outlook process), which is why the base score reaches 9.8. The independent assessment flags one material verification gap: the UI:N rating assumes attacker-supplied content is parsed without user action (for example via message preview or automatic processing), and if a crafted message must instead be opened by the recipient, the real-world exploitability is materially constrained and the effective vector would be closer to UI:R. Affected code paths exist across the Microsoft 365 Apps for Enterprise subscription channel and the LTSC 2021/2024 Windows and Mac editions enumerated under EUVD-2026-99728, meaning a single malformed message may be effective across a mixed-version estate.
Know when Outlook gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable unauthenticated stack overflow yielding code execution justifies AV:N/AC:L/PR:N and full C:H/I:H/A:H; UI:N retained per description/vendor vector, though Outlook delivery suggests UI:R should be verified.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Outlook is affected by a critical unauthenticated remote code execution vulnerability (CVE-2026-88156) that can execute code in the context of the logged-on user, potentially exposing mailbox data and enabling endpoint compromise. Although no public exploit identified at time of analysis, the attack is rated automatable with total technical impact, making pre-exploit patching a leadership priority. Patch available per vendor advisory for Windows LTSC, while Mac and subscription builds remain pending vendor release, creating a mixed-fleet risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrar
A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in m
A library injection vulnerability exists in Microsoft Outlook 16.83.3 for macOS. Rated critical severity (CVSS 9.1), thi
Microsoft Outlook Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely ex
Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1
Microsoft Outlook 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 allows remote attackers to execute arbitrary code via a craf
A remote code execution vulnerability exists in the way Microsoft Office software parses specially crafted email message
Microsoft Outlook Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely ex
SpotOutlook 1.2.6 contains a denial of service vulnerability in the registration name input field that allows attackers
Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Mic
Exploit-DB