Microsoft Outlook CVE-2026-97012

Exploitation requires a victim running Microsoft Office Outlook to open or preview a maliciously crafted email/message that triggers the stack-based buffer overflow (CWE-121); this user-interaction step (UI:R) is the primary limiting factor. No authentication or prior privileges are needed (PR:N) and the attack is delivered over the network (AV:N) against default Outlook configurations, so no special feature or non-default setting is required - the attacker's main constraint is social-engineering the target into viewing the crafted content. Affected builds per EUVD-2026-99798 include Microsoft Office LTSC 2021 before 16.0.14334.20974, Microsoft Office LTSC 2024 before 16.0.17932.21056, and Microsoft 365 Apps for Enterprise; patched builds are not vulnerable.

This is a genuine high-priority issue, though not the absolute top tier of urgency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, unauthenticated code execution with low attack complexity, limited only by required user interaction (UI:R). Combined with CWE-121 (stack-based buffer overflow) in a ubiquitously deployed client, the technical ceiling is remote code execution in the victim's security context. However, several escalating signals are ABSENT from the input: there is no CISA KEV listing, no EPSS score, no SSVC decision data, and no POC indicator - so exploitation status is 'no public exploit identified at time of analysis.' The gap between a high CVSS and the lack of any exploitation-maturity evidence means this should be patched promptly as part of a normal high-severity cycle, but there is no data here indicating active, widespread exploitation. The UI:R requirement is the single most important risk-reducing factor and separates this from a wormable zero-click bug. Note: the input provides EPSS/KEV/SSVC as empty, so the real-world exploitation-likelihood dimension cannot be quantified and should be re-checked against live threat intelligence before final prioritization.

An attacker crafts a malicious email or message that triggers the stack-based buffer overflow when the victim opens or previews it in Outlook, causing attacker-controlled code to execute in the user's context. Because exploitation requires user interaction (UI:R) but no authentication (PR:N) and works over the network (AV:N), a targeted phishing campaign delivering the crafted message is the most realistic delivery method. No public exploit code is identified in the provided data at time of analysis.