Microsoft Outlook EUVD-2026-100168

Exploitation requires the attacker to get a crafted message or attachment parsed/rendered by Microsoft Outlook - i.e., the victim must receive the item in a mailbox that Outlook opens or previews; it is not reachable without Outlook processing attacker-supplied content. The CVSS vector states no privileges and no user interaction (PR:N/UI:N), but in practice delivery-and-render is the gating factor, and preview-pane auto-rendering versus an explicit open determines whether any victim action is truly needed - verify the exact trigger with Microsoft's MSRC advisory. Limiting factors: impact is confidentiality-only (information disclosure, no code execution or integrity/availability loss), affected builds are bounded (e.g., Office LTSC 2021 <16.0.14334.20974, Office LTSC 2024 <16.0.17932.21056, plus Mac SKUs), and a vendor patch is already available, so patched or non-affected builds are not exploitable.

This is a genuinely networked, zero-interaction-on-paper disclosure flaw but sits in the 'important, not emergency' tier. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated triggering with high confidentiality impact (C:H) and no integrity or availability effect - consistent with an out-of-bounds read (CWE-125) that leaks memory. However, the corroborating signals argue against treating this as a drop-everything issue: CISA SSVC lists Exploitation as 'none' (no observed or public exploitation), and there is no KEV listing and no identified public POC. The one signal that elevates it is SSVC Automatable: yes, meaning the trigger (a crafted message/document reaching Outlook) can be mass-delivered, which pairs with the network vector to make opportunistic abuse feasible IF an exploit emerges. Technical Impact is rated 'partial,' aligning with an info-leak rather than code execution. EPSS was NOT provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Note a likely discrepancy: the vector asserts UI:N, but Outlook memory-disclosure bugs of this class are normally reached by the victim receiving and rendering a crafted message (often via the preview pane, which Microsoft counts as no explicit interaction) - verify whether preview-pane rendering alone triggers it. Net: a real priority to patch, but current evidence points to low near-term real-world risk rather than active, widespread exploitation.

An attacker emails a specially crafted message or attachment to a target; when Outlook parses/renders it, an out-of-bounds read leaks adjacent process memory (potentially cached message content, tokens, or heap data) back to attacker-influenced output. No public exploit code is identified at time of analysis, and the attack is automatable, so it could be fanned out across many recipients if weaponized. Low attack complexity means no special timing or environmental conditions are needed once a trigger message is crafted.