CVE-2026-70291: Microsoft Office Outlook Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Other sources
Microsoft Office Outlook Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.21056 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.14334.20974
Event History
Frequently Asked Questions
Which Outlook installations are in scope?
The affected software list includes Microsoft 365 Apps for Enterprise; Office LTSC 2024 for 32-bit, 64-bit, and Mac editions; Office LTSC 2021 for 32-bit, 64-bit, and Mac editions; and Office 365 for Mac.
Does exploitation require an authenticated account or user interaction?
The supplied CVSS vector indicates network reachability, low attack complexity, no privileges required, and no user interaction required. It describes an unauthorized attacker executing code over a network.
What is the potential impact if exploited?
Successful exploitation can allow remote code execution. The CVSS vector rates confidentiality, integrity, and availability impact as high.