EUVD-2026-56585
GHSA-25v6-4vqg-8444
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered exploit requires user interaction to open crafted content; no authentication needed; integer overflow enabling code execution yields full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Office Outlook stems from an integer overflow or wraparound condition (CWE-190) that allows an unauthenticated network attacker to execute arbitrary code on a victim's system, achieving full confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R reflects low attack complexity and no authentication requirement, though exploitation is gated by a user interaction step. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the attack profile is consistent with phishing-delivered malicious email or attachment campaigns targeting Outlook users.
Technical ContextAI
The root cause is CWE-190 (Integer Overflow or Wraparound), a class of flaw where arithmetic on length or size values produces a result that wraps around the maximum boundary of the integer type, yielding an unexpectedly small value. In an email client like Microsoft Office Outlook, such overflows typically arise during parsing of crafted message headers, attachment metadata, or embedded OLE objects where size calculations determine how much memory to allocate. The overflow produces an undersized buffer, and subsequent write operations overflow that buffer - consistent with the 'Buffer Overflow' tag accompanying this CVE - enabling an attacker to corrupt heap or stack memory and ultimately redirect execution flow. The CVSS vector AV:N/AC:L/PR:N/UI:R indicates the vulnerable parsing code path is reachable over the network with no special network position, requires no authentication, and is triggered by a standard user action such as opening or previewing a message. No CPE strings were provided in the input data, so exact affected build numbers must be confirmed via the MSRC advisory.
RemediationAI
The primary remediation is to apply the Microsoft-issued security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70329; an exact patched version number was not confirmed in the available intelligence and must be retrieved directly from the advisory. As compensating controls pending patching, administrators should ensure Outlook's Protected View is enforced via Group Policy so that attachments from external or untrusted sources open in a sandboxed read-only mode before any active content executes - note this may require users to explicitly enable editing and could affect workflow for legitimate documents. Configuring email security gateways to quarantine or strip suspicious attachment types (especially RTF, legacy Office formats, and OLE-bearing files) reduces the attack surface, though at the cost of potentially blocking legitimate business content. Disabling automatic preview in the Outlook reading pane for messages from outside the organization is an additional friction layer but does not eliminate risk from opened attachments.
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrar
A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in m
A library injection vulnerability exists in Microsoft Outlook 16.83.3 for macOS. Rated critical severity (CVSS 9.1), thi
Microsoft Outlook Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely ex
Microsoft Outlook 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 allows remote attackers to execute arbitrary code via a craf
A remote code execution vulnerability exists in the way Microsoft Office software parses specially crafted email message
Microsoft Outlook Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely ex
SpotOutlook 1.2.6 contains a denial of service vulnerability in the registration name input field that allows attackers
Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Mic
Microsoft Outlook 2016 allows an attacker to obtain the email content of a user, due to how Outlook 2016 discloses user
Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today