EUVD-2026-99803
GHSA-h6m4-54g6-gj6c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted email to target
-
DeliveryOutlook parses malicious content
-
ExploitTrigger double free in memory handling
-
ExecutionCorrupt heap and hijack execution
-
ImpactExecute arbitrary code as user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Double free prevention
|
| Exploitation Conditions | Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required beyond running an affected, unpatched Outlook build and receiving attacker-controlled message content that Outlook parses, which triggers the double free. Concrete prerequisites/limits: the target must run a vulnerable version - Microsoft Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, or an unpatched Microsoft 365 Apps for Enterprise build (fixed build not resolvable from input). The UI:N rating implies even preview/automatic parsing may trigger the flaw, but this is atypical for an email client and should be confirmed with MSRC; if exploitation actually requires the user to open the message, effective risk drops relative to the 9.8 score. |
| Impact | This is a genuine high-priority issue on static signals, but several key dynamic signals are missing. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case profile: network-reachable, low-complexity, unauthenticated, no user interaction, with High impact to confidentiality, integrity, and availability (base 9.8). CWE-415 (double free) is a memory-corruption class that is frequently escalatable to remote code execution, consistent with the description. However, there is NO EPSS score provided, NO CISA KEV listing, and NO public POC indicated, so the real-world exploitation likelihood cannot be quantified from this data - the 9.8 reflects theoretical worst-case severity, not demonstrated mass exploitation. One signal is internally questionable: UI:N is unusual for an Outlook client bug, which is typically triggered by a victim receiving/previewing a malicious email; Microsoft often scores preview-pane triggers as UI:N, but this should be verified against the MSRC advisory. The input 'Authentication Bypass' tag conflicts with both CWE-415 and the description (a double-free RCE is not an auth bypass) and appears mislabeled. Net: treat as high priority for patching given ubiquity of Outlook and RCE potential, but note that active-exploitation evidence is absent at time of analysis. |
| Exploit ScenarioDerived | An attacker sends a specially crafted email or message to a victim using an unpatched version of Microsoft Office Outlook. When Outlook parses the malicious content, the double-free condition (CWE-415) corrupts heap memory, and per the CVSS UI:N rating this can occur without the user explicitly opening the message, potentially allowing remote code execution in the context of the Outlook process. No public exploit code is identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Unauthenticated remote code execution in Microsoft Outlook is reachable when a vulnerable build parses attacker-controlled message content that triggers a double free (CWE-415), allowing the attacker to run code in the context of the Outlook process. Affected builds are Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft Office LTSC 2021 before 16.0.14334.20974, and unpatched Microsoft 365 Apps for Enterprise builds, per the EUVD affected-version data. The static profile is severe (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but no KEV listing, no EPSS value, and no public exploit code were provided; exploitation status is therefore "no public exploit identified at time of analysis," and a vendor patch is available (exact fixed builds known for the LTSC lines, not resolvable for Microsoft 365 Apps from the supplied input).
RemediationAI
Primary fix: apply the vendor updates - Microsoft Office LTSC 2024 build 16.0.17932.21056 and Microsoft Office LTSC 2021 build 16.0.14334.20974, and for Microsoft 365 Apps for Enterprise follow the current patch level published at https://aka.ms/OfficeSecurityReleases, since the exact fixed build is not resolvable from the supplied input; consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97749 for update channels and verification. Because the assessed vector is AV:N/AC:L/PR:N/UI:N, compensating controls cannot reliably stop the double free itself, so treat patching as the only complete fix and use the following as interim risk reduction with explicit trade-offs: enable Windows Defender Exploit Guard/ASR rules such as "Block Office applications from creating child processes" and "Block Office applications from injecting code into other processes" to disrupt post-exploitation behavior (trade-off: can break legitimate add-ins, COM automation, and mail-merge workflows), and deploy gateway/EDR filtering that quarantines malformed or exploit-pattern message content before delivery to Outlook (trade-off: false positives on legitimate rich-content mail and reduced delivery assurance). Restricting Outlook to plain-text rendering or disabling the reading/preview pane may limit some trigger paths, but per the UI:N assessment it must not be assumed to eliminate exposure, and it degrades usability by breaking HTML formatting, links, and inline images; similarly, network isolation or segmented mail egress reduces attacker reachability but adds operational overhead. Confirm with MSRC whether actual exploitation requires message interaction, as that determination materially changes the priority of the interim controls relative to the 9.8 score.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a memory-management defect in the CWE-415 (double free) class, in which the same heap allocation is released twice while Outlook processes attacker-supplied message content; the second release corrupts heap metadata and, in practice, can be shaped into controlled memory corruption that supports arbitrary code execution. The affected code path belongs to Microsoft Office Outlook, identified in the EUVD data against Microsoft Office LTSC 2024, Microsoft Office LTSC 2021, and Microsoft 365 Apps for Enterprise; the reference set includes only the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97749), and the input carries an "Authentication Bypass" tag alongside "Microsoft," which does not align cleanly with the CVSS vector and should be treated as a vendor/catalog keyword rather than a description of the prerequisite. The assessed vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates exploitability over the network with no privileges and no user interaction, meaning the vulnerable parsing routine is reached by attacker-controlled message content rather than by a deliberate user action; the assessment notes that UI:N is atypical for an email client and should be confirmed with MSRC, because if interaction (opening or fully rendering the message) is actually required, the effective risk is lower than the 9.8 base score implies.
Know when Outlook gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-delivered, unauthenticated double-free RCE per description and CWE-415; UI:N retained to match the vendor vector though a preview/open trigger could justify UI:R.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Outlook users across Office LTSC 2024, Office LTSC 2021, and Microsoft 365 Apps for Enterprise are exposed to a critical unauthenticated remote code execution vulnerability that could let an attacker run code in the context of the Outlook process. Because no authentication or user interaction is required, a successful attack could compromise user sessions, lead to data theft, or enable lateral movement within the organization. Leadership should treat this as a high-priority patching event; no public exploit identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrar
A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in m
A library injection vulnerability exists in Microsoft Outlook 16.83.3 for macOS. Rated critical severity (CVSS 9.1), thi
Microsoft Outlook Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely ex
Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1
Microsoft Outlook 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 allows remote attackers to execute arbitrary code via a craf
A remote code execution vulnerability exists in the way Microsoft Office software parses specially crafted email message
Microsoft Outlook Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely ex
SpotOutlook 1.2.6 contains a denial of service vulnerability in the registration name input field that allows attackers
Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Mic
Exploit-DB