EUVD-2026-87317Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious email triggering integer overflow
-
DeliveryDeliver message to target inbox
-
ExploitVictim opens or previews message
-
ExecutionOverflow corrupts Outlook memory
-
ImpactExecute arbitrary code as user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to deliver a specially crafted message to an Outlook user and have that user open or preview it (UI:R) - no attacker authentication is needed (PR:N), but the flaw is not triggerable without victim action. Reliable code execution is further limited by high attack complexity (AC:H): the integer overflow must be shaped into a controllable memory-corruption condition, which typically demands precise heap/memory grooming rather than a single deterministic trigger. Affected are Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 installations of Outlook; an official patch is available, so unpatched versions are the limiting deployment factor. |
| Impact | The CVSS 3.1 base score of 7.5 reflects a network-reachable (AV:N) remote code execution flaw, but every real-world signal points to constrained, non-urgent risk rather than an imminent threat. The vector itself tempers the score: AC:H means the integer overflow requires specific, hard-to-arrange conditions (e.g. precise memory layout/heap grooming) to reach reliable code execution, and UI:R means a victim must open or preview a crafted message. The provided temporal metrics are decisive here: E:U (Exploit Code Unproven), RL:O (Official fix available), and RC:C (Confirmed report). No EPSS score was supplied, this CVE is not indicated as KEV-listed, and no POC is referenced - consistent with the E:U temporal marker. Bottom line: this is a genuine RCE with high potential impact (C:H/I:H/A:H) in an extremely widely deployed product, but the combination of high attack complexity, mandatory user interaction, an available official patch, and no evidence of exploitation places it as an important-to-patch issue rather than an emergency. No signals conflict; all point toward 'patch in normal cycle, prioritized by Office ubiquity.' |
| Exploit ScenarioDerived | An attacker crafts a malicious email (or attachment/message structure) that triggers the integer overflow when Outlook parses it, and sends it to a target. The victim opens or previews the message, at which point the overflow corrupts memory and - if the attacker's grooming succeeds (AC:H) - leads to code execution in the user's context. No public exploit code is identified at time of analysis (temporal E:U), and no authentication is required of the attacker (PR:N), but user interaction is mandatory (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Remote code execution in Microsoft Outlook (Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024) can be triggered when a user opens or previews a specially crafted message, though successful exploitation depends on shaping an integer overflow into controllable memory corruption. The CVSS 3.1 base score is 7.5 with high attack complexity (AC:H), no attacker authentication (PR:N), and required user interaction (UI:R); the independent assessment characterizes the risk as constrained and non-urgent rather than an imminent threat. An official vendor patch is available, and no public exploit or active exploitation (CISA KEV) is identified in the provided data.
RemediationAI
Apply the vendor-released patch per Microsoft's update guide for CVE-2026-100208 at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100208; this is the authoritative source for applicable builds across Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024. Because exploitation requires a user to open or preview a crafted message, interim mitigations include configuring Outlook to read all messages in plain text (reduces HTML/RTF attack surface but degrades formatting), disabling the Reading Pane automatic preview (reduces accidental exposure but affects workflow), and blocking or sandboxing untrusted message content at the email gateway (adds filtering overhead and possible false positives). These controls reduce exposure but do not replace patching, and their usability or compatibility trade-offs should be weighed against the constrained, user-interaction-dependent risk described by the independent assessment.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-190 describes an integer overflow or wraparound condition in Microsoft Outlook that can lead to memory corruption when processing a specially crafted message. The affected products are identified by CPE as Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, with Outlook being the vulnerable component. The vulnerability is network-reachable (AV:N) and requires no attacker authentication (PR:N), but exploitation requires victim interaction (UI:R) and high attack complexity (AC:H) because the overflow must be converted into a controllable corruption primitive, typically requiring precise heap or memory grooming. Tags also associate the issue with buffer overflow and integer overflow behavior.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered malicious message (AV:N) needs no attacker auth (PR:N) but requires victim to open it (UI:R) and difficult memory grooming (AC:H); successful code execution yields full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Outlook, as deployed in Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024, is affected by a high-severity remote code execution vulnerability that could let an attacker gain control of a user's system when they open or preview a malicious message. Although exploitation requires user interaction and high attack complexity, a successful compromise could disrupt business operations, expose sensitive data, or serve as a foothold for broader network attacks. Leadership should prioritize remediation because Outlook is a critical communication tool used across the organization, and a vendor patch is available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
GitHub PoC
Exploit-DB