CVE-2026-77493 – Microsoft Office Outlook Remote Code Execution Vulnerability

CVE-2026-77493 is a critical remote code execution vulnerability caused by a double-free memory handling issue in Microsoft Office Outlook. An attacker can send a specially crafted email to a target, and simply viewing that message in the Outlook Reading Pane can trigger the vulnerability. Successful exploitation could allow attacker-controlled code to execute on the recipient’s system. The affected Microsoft product is identified as Microsoft Office Outlook; the affected-software table specifically lists supported Windows client and Windows Server versions.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: An unauthorized network attacker can target Outlook with a specially crafted email. Attack complexity is low, privileges are not required, and user interaction is not required. Successful exploitation can have high confidentiality, integrity, and availability impact.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as Unproven, and the exploitation assessment is “Exploitation Less Likely.” No confirmed public exploit, zero-day exploitation, or proof-of-concept code is identified.

TECHNICAL SUMMARY: CVE-2026-77493 is a CWE-415 double-free vulnerability in Microsoft Office Outlook. A double free occurs when memory is freed more than once, potentially creating memory corruption that can be leveraged for unintended code execution. An attacker can deliver a specially crafted email over the network. The vulnerability can be triggered when the email is displayed in the Outlook Reading Pane, without requiring the recipient to open the message or click its contents. Successful exploitation can result in remote code execution on the recipient’s system, with high potential impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected software listed includes Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2 and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including listed Server Core installations. A specially crafted email viewed in the Outlook Reading Pane can trigger exploitation over the network without authentication or user interaction.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution on affected systems, potentially compromising sensitive information, changing data, or disrupting system availability. Because a malicious email can trigger the flaw through the Reading Pane without requiring a click, normal email viewing could become an entry point for system compromise.

WORKAROUND: No workaround or mitigation is identified. An official fix is listed as the remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8. Its network attack vector, low attack complexity, lack of required privileges, and lack of required user interaction make prompt deployment important, even though exploitation is currently assessed as less likely and no exploitation is identified.