Microsoft Outlook EUVD-2026-99717

Exploitation requires the target to receive and have Outlook process a crafted email message that triggers the heap-based buffer overflow during parsing/rendering; affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the macOS Outlook/Office builds (Office LTSC for Mac 2021/2024, Office 365 for Mac). The CVSS vector asserts no privileges and no user interaction (PR:N/UI:N), implying a preview-pane/zero-click trigger against default configurations rather than requiring the user to open or click the message. Limiting factors: exploitation is bounded to installations running unpatched vulnerable builds, and SSVC currently reports Exploitation: none, so no active or public exploitation is occurring at time of analysis; if Microsoft's advisory in fact requires the user to open the message, the UI:N claim overstates reach.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated code execution with total CIA impact (C:H/I:H/A:H), yielding a 9.8 Critical. CISA's SSVC framework reinforces this: Technical Impact is 'total' and the flaw is 'Automatable: yes', meaning an attacker could reliably script delivery and triggering at scale. However, the signals are not uniformly alarming - SSVC Exploitation is 'none', and there is no CISA KEV listing and no public POC, so there is no public exploit identified at time of analysis and no evidence of in-the-wild use yet. EPSS was not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Note one tension to verify: the vector asserts UI:N (zero interaction), which for an email client typically implies a preview-pane/zero-click trigger; if exploitation in fact requires the victim to open a crafted message, real-world risk is marginally lower than the raw 9.8 suggests - verify the interaction requirement with Microsoft's MSRC advisory. Given ubiquitous deployment, a vendor patch is already available, and 'Automatable: yes' with 'total' impact, this should be prioritized for prompt patching even absent current exploitation.

An attacker sends a specially crafted email whose malformed content triggers a heap-based buffer overflow in Outlook's message parsing, corrupting heap memory to achieve arbitrary code execution in the victim's Outlook process. Because the CVSS vector specifies UI:N, this may trigger on message preview/rendering without the user clicking anything. No public exploit code has been identified at time of analysis.