CVE-2026-78510 – Microsoft Office Outlook Remote Code Execution Vulnerability

CVE-2026-78510 is a critical heap-based buffer overflow vulnerability in Microsoft Office Outlook that can allow an unauthenticated attacker to execute arbitrary code over a network. An attacker can craft a malicious RTF file that triggers the vulnerability when opened or rendered in the Preview Pane. Successful exploitation can compromise confidentiality, integrity, and availability with code executing in the user’s context.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, requires no privileges, and requires no user interaction according to its CVSS metrics. Successful exploitation can result in arbitrary code execution in the user’s context, with high impact to confidentiality, integrity, and availability.

EXPLOITS: This vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. The source does not confirm a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-78510 is caused by a heap-based buffer overflow in Microsoft Office Outlook. An unauthenticated attacker can craft a malicious RTF file that triggers the vulnerability. The malicious content can execute when the file is opened or when it is rendered in the Outlook Preview Pane, which is explicitly identified as an attack vector. Successful exploitation allows arbitrary code execution in the user’s context and can cause high confidentiality, integrity, and availability impacts.

EXPLOITABILITY: Affected products include Microsoft 365 Apps for Enterprise for 32-bit and 64-bit systems; Microsoft Office 2019, LTSC 2021, and LTSC 2024 for 32-bit and 64-bit editions; and Microsoft Word 2016 32-bit and 64-bit editions. Exploitation can occur through a crafted malicious RTF file opened or rendered in the Preview Pane.

BUSINESS IMPACT: Successful exploitation could allow arbitrary attacker-controlled code to run in a user’s context, creating significant risk to organizational systems and information. With high confidentiality, integrity, and availability impacts, exploitation could expose sensitive information, permit unauthorized changes, and disrupt affected systems.

WORKAROUND: No mitigations or workarounds are specified. An official fix is identified as the remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8. Its network attack vector, low attack complexity, lack of required privileges or user interaction, and ability to execute arbitrary code make timely deployment important, even though exploitation is currently assessed as Less Likely and is not reported as active.