CVE-2026-70291 – Microsoft Office Outlook Remote Code Execution Vulnerability

Microsoft has identified a critical Remote Code Execution (RCE) vulnerability in Microsoft Office Outlook that could allow an unauthenticated attacker to execute malicious code on a vulnerable system. The vulnerability, tracked as CVE-2026-70291, is caused by a heap-based buffer overflow and carries a CVSS score of 9.8. An attacker could exploit this weakness by sending a specially crafted email to a target user. Simply displaying the malicious message in Outlook’s Reading Pane could trigger the vulnerability without requiring the recipient to open the email or click any links. Successful exploitation could compromise sensitive information, allow unauthorized system modifications, or disrupt business operations.

CVSS SCORE: 9.8

SEVERITY: Critical

Threat

This vulnerability presents a significant security threat because attackers can potentially execute malicious code remotely without authentication or user interaction.

The most concerning aspect is that Outlook’s Preview Pane is an attack vector. An attacker could deliver a malicious email that triggers the vulnerability when Outlook displays its contents.

The attack requires:

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None

Successful exploitation could allow attackers to access sensitive information, modify system data, or disrupt affected systems.

Because email is widely used across organizations, this vulnerability creates a potentially dangerous entry point into corporate environments.

Exploits

Microsoft classifies this vulnerability as Exploitation Less Likely.

At the time of publication, the vulnerability was not publicly disclosed and had no reported exploitation in the wild.

The exploit code maturity is classified as Unproven, meaning there is no confirmed evidence of working exploit code.

The existence of publicly available proof-of-concept (PoC) exploit code cannot be confirmed.

There is also no confirmed evidence that this vulnerability has been exploited as a zero-day.

However, the vulnerability remains particularly concerning because exploitation does not require authentication or user interaction.

Technical Summary

CVE-2026-70291 is a heap-based buffer overflow vulnerability (CWE-122) affecting Microsoft Office Outlook.

A heap-based buffer overflow occurs when an application writes more data into a dynamically allocated memory buffer than the buffer can safely accommodate. This can corrupt adjacent memory and potentially allow an attacker to execute unauthorized code.

In this case, the vulnerability can be triggered when Outlook processes a specially crafted email message.

An attacker could exploit the vulnerability through the following sequence:

1. The attacker creates a specially crafted email designed to trigger the heap-based buffer overflow.

2. The malicious email is delivered to a targeted Outlook user.

3. Outlook processes the message when it appears in the Reading Pane.

4. The malformed content triggers memory corruption.

5. Successful exploitation could allow the attacker to execute malicious code on the affected system.

The most dangerous characteristic is that the recipient does not need to open the email or click anything inside it.

The vulnerability has the following technical characteristics:

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

These characteristics indicate that successful exploitation could seriously compromise the confidentiality, integrity, and availability of affected systems.

Microsoft has identified an official fix for this vulnerability.

Exploitability

The vulnerability affects Microsoft Office Outlook within the following Microsoft products:

• Microsoft 365 Apps for Enterprise (32-bit and 64-bit)
• Microsoft Office LTSC 2021 (32-bit and 64-bit)
• Microsoft Office LTSC 2024 (32-bit and 64-bit)

Specific vulnerable build numbers and fixed build numbers are not confirmed.

An unauthenticated attacker could exploit the vulnerability by sending a specially crafted email that triggers malicious code execution when Outlook processes it in the Reading Pane.

No privileges or user interaction are required.

Microsoft rates exploitation as Less Likely, and no active exploitation has been reported.

Business Impact

This vulnerability poses a serious risk to organizations that rely on Microsoft Outlook for daily business communications.

Because Outlook is widely used to exchange business information, attackers could potentially exploit this vulnerability through a common and trusted communication channel.

Successful exploitation could result in:

• Unauthorized System Access: Attackers could execute malicious code on compromised systems.
• Sensitive Data Exposure: Confidential business information, emails, and other sensitive data could be exposed.
• System Compromise: Attackers could modify information or interfere with normal system operations.
• Operational Disruption: Compromised systems could experience service interruptions that affect employee productivity.
• Financial and Reputational Damage: Security incidents could lead to recovery expenses, operational losses, and reduced customer confidence.

The vulnerability is especially concerning because employees may encounter malicious emails during routine activities without performing any suspicious actions.

“When simply previewing an email can trigger malicious code, everyday communication becomes a potential security risk.”

Organizations with large Outlook deployments could face significant exposure if vulnerable systems remain unpatched.

Workaround

Microsoft has not identified any official workarounds or mitigations for this vulnerability.

The recommended action is to deploy the official Microsoft security update to affected products.

Until patching is completed, organizations should prioritize identifying vulnerable Outlook installations and monitoring for suspicious email activity.

These precautions are not confirmed substitutes for the security update.

Urgency

Critical – Prioritize Deployment

CVE-2026-70291 carries a CVSS score of 9.8, making it a critical vulnerability that should receive high priority in patch deployment schedules.

Although Microsoft currently considers exploitation less likely and has not reported active exploitation, several characteristics make this vulnerability particularly dangerous.

Most importantly, an attacker does not need authentication or user interaction to exploit the weakness.

The ability to trigger the vulnerability through Outlook’s Reading Pane significantly increases the potential exposure of affected users.

Organizations should prioritize deploying the official Microsoft security update across affected Microsoft 365 Apps for Enterprise and Office LTSC installations.

Delaying deployment leaves affected systems exposed to a critical remote code execution vulnerability that could be triggered through routine email activity.