CVE-2026-97012: Microsoft Office Outlook Remote Code Execution Vulnerability
Microsoft Office Outlook Remote Code Execution Vulnerability
Other sources
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.21056 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.14334.20974 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases
Event History
Frequently Asked Questions
Does exploitation require an authenticated Outlook user or other attacker privileges?
No attacker privileges are required (PR:N), and the issue is reachable over the network (AV:N). However, exploitation requires user interaction (UI:R); the provided data does not specify what interaction is needed.
Which Outlook-related product editions are identified as affected?
The affected software list includes Microsoft 365 Apps for Enterprise and Microsoft Office LTSC 2021 and 2024 in both 32-bit and 64-bit editions.