EUVD-2026-99711
GHSA-354c-x8wf-x4mr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted email to target
-
DeliveryVictim opens or previews message
-
ExploitTrigger heap buffer overflow in Outlook parser
-
ExecutionExecute arbitrary code as user
-
ImpactCompromise mailbox and endpoint
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to deliver a specially crafted message or object to the victim and for the victim to open or render it in Microsoft Outlook (CVSS UI:R) - no attacker authentication is needed (PR:N). The limiting factor is this mandatory user interaction: the overflow fires only when a user processes the malicious content in Outlook, so it is not wormable or automatable (SSVC Automatable=no). Affected builds per EUVD are Microsoft 365 Apps for Enterprise, Office LTSC 2021 (below 16.0.14334.20974), and Office LTSC 2024 (below 16.0.17932.21056); patched builds are available from the vendor, so fully updated installations are not exposed. Verify with Microsoft whether preview-pane rendering alone triggers the flaw, as that would broaden the realistic exposure. |
| Impact | This is a credible mid-to-high priority issue, but not a drop-everything emergency based on current signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated heap overflow (CWE-122) yielding full confidentiality, integrity and availability impact - i.e. code execution in the user's context. The single mitigating metric is UI:R: a victim must open or preview a crafted message/attachment, so this is not self-propagating. CISA's SSVC framework reinforces a measured posture: Exploitation=none (no observed or public exploitation), Automatable=no (consistent with the required user interaction), but Technical Impact=total. No KEV listing and no POC are present in the input, so by the precision rules this is 'no public exploit identified at time of analysis.' EPSS is NOT provided in the input, so exploitation probability cannot be quantified here. In short: high technical impact and a classic, attractive client-side RCE target, but the required user interaction and absence of any exploitation evidence put it in the 'patch promptly, not panic' tier. Note one ambiguity to verify with Microsoft: whether triggering requires actively opening an attachment versus mere preview-pane rendering materially changes real-world risk. |
| Exploit ScenarioDerived | An attacker emails a victim a message containing a maliciously crafted object that triggers a heap-based buffer overflow when Outlook parses it. When the user opens (or possibly previews) the message, the overflow corrupts heap memory and the attacker achieves arbitrary code execution in the context of the Outlook user. No public exploit code is identified at time of analysis, and the network attack vector pairs with low complexity but requires that one user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Heap-based buffer overflow in Microsoft Office Outlook (CWE-122) lets a remote, unauthenticated attacker execute arbitrary code in the context of the Outlook process by delivering a specially crafted message or object that the victim must open or render. Affected builds per EUVD-2026-99711 are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 below 16.0.14334.20974, and Microsoft Office LTSC 2024 below 16.0.17932.21056; CVSS 3.1 is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with the mandatory user interaction being the only meaningful barrier. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, and SSVC records Exploitation=none with Automatable=no, so this is a credible mid-to-high priority client-side issue rather than an emergency; no EPSS score was supplied in the feed, so no probabilistic exploitation estimate can be cited.
RemediationAI
Vendor-released patch: Microsoft Office LTSC 2021 build 16.0.14334.20974 and Microsoft Office LTSC 2024 build 16.0.17932.21056 are the fixed builds, and Microsoft 365 Apps for Enterprise is remediated by applying current updates from https://aka.ms/OfficeSecurityReleases; deploy these through Microsoft Update, Windows Update/Configuration Manager, or your Office update channel and inventory Outlook builds against the EUVD thresholds. Treat Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70282 as the canonical source and confirm with Microsoft whether preview-pane rendering alone is sufficient to trigger the overflow, since if it is, exposure is broader than a simple 'do not open the attachment' posture suggests. Until patching completes, compensating controls and their trade-offs are: disable or restrict the Outlook reading/preview pane so messages are rendered only on explicit open (reduces one-click exposure but degrades triage workflow for heavy mail users); enforce Protected View and disable automatic rendering/download of remote content and OLE objects (blocks the parsing path but can break legitimate rich messages and embedded content); strip or quarantine risky attachment types and external-origin RTF/HTML messages at the mail gateway (reduces delivery of crafted content but cannot be made complete because the trigger format is not fully documented publicly); and run Outlook with attack surface reduction rules and, where feasible, in a non-administrative user context to cap the impact of successful code execution. None of these compensating controls has the same efficacy as applying the patched builds.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-122, a heap-based buffer overflow, meaning a length or size value derived from attacker-controlled message content is trusted when allocating or indexing a heap buffer, so a write can land past the end of the allocation and corrupt adjacent heap metadata or objects. Outlook is a client application that parses complex, attacker-suppliable formats (MIME/RTF/HTML bodies and embedded OLE objects) using native parsing code, which is the classic setting for this bug class; successful corruption can be steered into controlled code execution running at the privilege level of the Outlook process, and the CVSS scope is Unchanged (S:U), so the compromise is contained to that process and the user's session rather than the whole system context by definition of the vector. The vector AV:N/AC:L/PR:N/UI:R describes network-delivered content, low attack complexity, no attacker credentials, and a required victim action: opening or rendering the malicious message or object. Because the flaw fires only on that user-triggered parse, it is not automatable and not wormable (SSVC Automatable=no), though CISA's SSVC entry rates Technical Impact as total, consistent with the High confidentiality, integrity, and availability ratings in the CVSS vector. EUVD-2026-99711 supplies the affected version boundary data (Microsoft 365 Apps for Enterprise, Office LTSC 2021, Office LTSC 2024); explicit CPE strings were not included in the provided intelligence, so product identification here rests on the EUVD version list and the Microsoft update guide rather than on CPE matching.
Know when Outlook gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered crafted content, no attacker privileges (PR:N) but a user must open/preview it (UI:R); memory-corruption RCE in user context gives full C/I/A with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Outlook is affected by a high-severity remote code execution vulnerability that requires a user to open or render a crafted message or object, potentially allowing compromise of the user's endpoint and access to email, credentials, and connected business data. Because Outlook is widely deployed in corporate environments, leadership should prioritize rapid patching to reduce the chance that a single user action leads to broader enterprise exposure. Microsoft has released a patch, and no public exploit identified at time of analysis or confirmed actively exploited (CISA KEV) status has been identified.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrar
A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in m
A library injection vulnerability exists in Microsoft Outlook 16.83.3 for macOS. Rated critical severity (CVSS 9.1), thi
Microsoft Outlook Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely ex
Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1
Microsoft Outlook 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 allows remote attackers to execute arbitrary code via a craf
A remote code execution vulnerability exists in the way Microsoft Office software parses specially crafted email message
Microsoft Outlook Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely ex
SpotOutlook 1.2.6 contains a denial of service vulnerability in the registration name input field that allows attackers
Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Mic
Exploit-DB