CVE-2026-78519 – Microsoft Office Outlook Remote Code Execution Vulnerability

CVE-2026-78519 is a critical remote code execution vulnerability in Microsoft Office Outlook caused by the use of an uninitialized resource. An unauthorized attacker can send a specially crafted email to a victim, and exploitation may occur when the victim opens the email or when an affected Outlook application displays its preview. Successful exploitation could allow the attacker to execute remote code on the victim’s machine.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker can target affected Outlook users remotely with a specially crafted email. Successful exploitation could execute attacker-controlled code on the victim’s machine, making malicious email a direct route to system compromise.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Its exploitation assessment is “Exploitation Less Likely.” No zero-day exploitation or proof-of-concept exploit code is confirmed.

TECHNICAL SUMMARY: The vulnerability is associated with CWE-908, Use of Uninitialized Resource, in Microsoft Office Outlook. An unauthorized attacker can exploit the flaw over a network by sending a specially crafted email. Exploitation may involve a victim opening the malicious email with an affected version of Outlook or Outlook displaying a preview of that email. Successful exploitation could result in remote code execution on the victim’s machine. The source does not specify the privileges or user interaction requirements beyond these email-based scenarios.

EXPLOITABILITY: Affected products include Microsoft 365 Apps for Enterprise for 32-bit and 64-bit systems; Microsoft Office 2019, LTSC 2021, and LTSC 2024 in 32-bit and 64-bit editions; and Microsoft Outlook 2016 in 32-bit and 64-bit editions. The attack can use a specially crafted email that is opened or displayed in Outlook preview.

BUSINESS IMPACT: Successful remote code execution could allow malicious code to run on an employee’s machine, potentially compromising the endpoint and information accessible from it. For organizations, a crafted email that reaches an affected Outlook environment creates a serious security risk because normal email handling can become an avenue for code execution.

WORKAROUND: No workaround or mitigation is specified. Organizations unable to apply the patch cannot rely on a confirmed vendor workaround for this vulnerability.

URGENCY: This vulnerability carries a Critical severity rating and can result in remote code execution through a specially crafted email. Although exploitation is assessed as less likely and no active exploitation is reported, affected Outlook and Office installations should be prioritized for patching because successful exploitation could execute remote code on a victim’s machine.