CVE-2026
We use optional cookies to improve your experience on our websites, such as through social media connections, and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services will be used. You may change your selection by clicking “Manage Cookies” at the bottom of the page. Privacy Statement Third-Party Cookies
Released: Sep 8, 2026
Please see Common Vulnerability Scoring System for more information on the definition of these metrics.
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
The following table provides an exploitability assessment for this vulnerability at the time of original publication.
According to the CVSS metric, the attack vector is network (AV:N) and user interaction is required (UI:R). What is the target context of the remote code execution?
This attack requires a user to open a specially crafted file from the attacker to initiate remote code execution.
Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector.
0ccbbf129444eb66344ccafb92b00df4
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle .
Information published.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
