CVE-2026-70257: Microsoft Office Outlook Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Other sources
Microsoft Office Outlook Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.14334.20974 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.21056
Event History
Frequently Asked Questions
Which Outlook product editions are listed as affected?
The listed products are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 for 32-bit and 64-bit editions, and Microsoft Office LTSC 2024 for 32-bit and 64-bit editions.
Does exploitation require an authenticated account or user interaction?
The vector indicates no attacker privileges are required, but user interaction is required. The attack vector is network-based and has low attack complexity.
What could successful exploitation allow?
Successful exploitation could allow code execution and is rated as having high impact on confidentiality, integrity, and availability.