CVE-2026-78509 – Microsoft Office Outlook Remote Code Execution Vulnerability

CVE-2026-78509 is a Critical heap-based buffer overflow vulnerability in Microsoft Office Outlook that could allow an unauthorized remote attacker to execute code on a target system. An attacker can send a specially crafted email, and simply viewing it in the Outlook Reading Pane can trigger the vulnerability without opening the message or clicking anything. The CVSS base score is 9.8, and exploitation requires neither authentication nor user interaction.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: An attacker could remotely deliver a specially crafted email that triggers a heap-based buffer overflow when Outlook processes the message. The vulnerability has network reachability, low attack complexity, requires no privileges or user interaction, and successful exploitation can have a high impact on confidentiality, integrity, and availability.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit Code Maturity is Unproven, and exploitation is assessed as Less Likely. The source does not confirm a public exploit, zero-day exploitation, or publicly available proof-of-concept code.

TECHNICAL SUMMARY: CVE-2026-78509 is caused by a heap-based buffer overflow in Microsoft Office Outlook. A remote, unauthorized attacker can exploit the flaw by sending a specially crafted email to a target user. The Outlook Reading Pane is an attack vector, meaning processing the malicious message there can trigger the vulnerability without the recipient opening the email or clicking content. Network access is required, but authentication, privileges, and user interaction are not. Successful exploitation can execute code on the recipient’s system and can result in high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected software includes Microsoft 365 Apps for Enterprise for 32-bit and 64-bit systems; Microsoft Office 2019 for 32-bit and 64-bit editions; Microsoft Office LTSC 2021 and LTSC 2024 for 32-bit and 64-bit editions; and Microsoft Word 2016 for 32-bit and 64-bit editions. A specially crafted email can trigger exploitation through the Outlook Reading Pane.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution on employee systems, putting sensitive information, system integrity, and system availability at risk. Because a malicious email can trigger the flaw without a click or other user interaction, normal user caution alone may not prevent an attack.

WORKAROUND: No mitigations or workarounds are identified. An official fix is identified as the remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8. Its network attack vector, low attack complexity, lack of privilege and user-interaction requirements, and potential for remote code execution make timely deployment important. Although exploitation is currently assessed as Less Likely and no exploitation is confirmed, affected systems should be prioritized for the official fix.