Microsoft Outlook CVE-2026-97016

Exploitation requires the target to run an affected Microsoft Office/Outlook build (Microsoft 365 Apps for Enterprise before the patched release, Office LTSC 2024 before 16.0.17932.21056, or Office LTSC 2021 before 16.0.14334.20974) and to receive an attacker-crafted email that Outlook parses. Per the vendor CVSS vector (PR:N/UI:N), no authentication and no explicit user click are required - consistent with Outlook's automatic message rendering/Preview Pane processing being the trigger. Limiting factors: the victim's Outlook must be updated to a vulnerable version and must receive/render the malicious message; applying the available vendor patch fully removes the condition, and disabling automatic preview/rendering would raise the effective interaction requirement.

This is a genuine high-priority vulnerability, not a high-CVSS/low-real-risk paper tiger. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H → 9.8) describes the most dangerous possible profile: network-reachable, low-complexity, no privileges, and - per the vendor-assigned vector - no user interaction, yielding full confidentiality, integrity, and availability compromise. The affected product (Microsoft Outlook / Office) is an extremely high-value, near-ubiquitous target historically favored for email-borne exploitation. Tempering this, several exploitation signals are ABSENT from the input: no EPSS score was provided, there is no CISA KEV listing, no POC availability indicator, and no SSVC decision data - so there is NO confirmation of active or imminent exploitation, only the theoretical severity of the flaw. One point warrants vendor verification: the vector asserts UI:N, yet Outlook heap-overflow RCEs are frequently triggered via email parsing/Preview Pane, which Microsoft conventionally rates as UI:N even though an email must still be received and auto-rendered - verify whether default Preview Pane behavior is the trigger. Net: treat as urgent-to-patch due to severity, product footprint, and a vendor patch already being available, while recognizing exploitation itself is currently unproven in the supplied data.

A remote attacker crafts a malicious email message that, when received and rendered by Outlook (e.g., via the Preview Pane per the UI:N rating), triggers a heap-based buffer overflow in Outlook's message-parsing code and executes attacker-controlled code in the user's context. No authentication or explicit victim click is indicated by the CVSS vector. No public exploit code is identified in the provided intelligence at time of analysis.