CVE-2026-97012: Microsoft Office Outlook Remote Code Execution Vulnerability
Overview
- Severity
- High (CVSS 8.8)
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Category
- Remote Code Execution
- Exploit Status
- Not Exploited
- Exploitation Likelihood
- Less Likely
- Patch Tuesday
- 2026-Oct
- Released
- 2026-10-13
Description
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
FAQ
How could an attacker exploit this vulnerability?
An attacker could host a malicious server and convince a user to connect to it from an affected client. When the client processes the server's response, the attacker could execute code on the client system. User interaction is required.
Affected Products (6)
Microsoft Office
- Microsoft Office LTSC 2021 for 64-bit editions
- Microsoft Office LTSC 2021 for 32-bit editions
- Microsoft Office LTSC 2024 for 64-bit editions
- Microsoft Office LTSC 2024 for 32-bit editions
- Microsoft 365 Apps for Enterprise for 64-bit Systems
- Microsoft 365 Apps for Enterprise for 32-bit Systems
Acknowledgments
0ccbbf129444eb66344ccafb92b00df4
Revision History
- 2026-10-13: Information published.