CVE-2026-78520 – Microsoft Office Outlook Information Disclosure Vulnerability

CVE-2026-78520 is a Microsoft Office Outlook vulnerability caused by an out-of-bounds read. An unauthorized remote attacker can target the vulnerability over a network, and exploitation requires user interaction. Microsoft confirms that the Outlook Preview Pane is an attack vector. Successful exploitation could allow an attacker to read small portions of heap memory, potentially exposing sensitive information stored in memory.

CVSS Score: 6.5

SEVERITY: Critical

THREAT: The vulnerability creates a remote information disclosure risk in Microsoft Office Outlook. An attacker does not require privileges and can deliver malicious content over a network. Because the Preview Pane is an attack vector, users may be exposed while previewing a specially crafted Outlook item rather than deliberately opening it.

EXPLOITS: Microsoft reports that the vulnerability is not publicly disclosed and not currently exploited. The exploitability assessment is Exploitation Less Likely. CVSS v3.1 lists exploit code maturity as Unproven. The available data does not confirm the existence of public proof-of-concept exploit code or active zero-day exploitation.

TECHNICAL SUMMARY: CVE-2026-78520 is caused by an out-of-bounds read in Microsoft Office Outlook. The flaw can cause Outlook to access memory outside the intended buffer boundary when processing specially crafted content. An unauthorized attacker can target the issue remotely over a network without requiring existing privileges, although user interaction is required. Microsoft confirms that the Preview Pane can trigger the vulnerability. Successful exploitation could allow the attacker to read small portions of heap memory. The CVSS v3.1 metrics indicate a high confidentiality impact, with no confirmed integrity or availability impact. The supplied data labels the overall impact as Remote Code Execution, while the FAQ specifically confirms disclosure of heap memory.

EXPLOITABILITY: The affected Microsoft product is Microsoft Office Outlook. Microsoft Office LTSC for Mac 2021 and 2024 are also identified in the available information, but their security updates were not immediately available at the time of release. Specific affected Outlook versions beyond this cannot be confirmed from the available data. The attack can be delivered remotely and requires user interaction, with the Outlook Preview Pane confirmed as an attack vector.

BUSINESS IMPACT: Successful exploitation could expose portions of Outlook process memory containing sensitive information. Depending on what is present in memory at the time of exploitation, this could contribute to disclosure of confidential business data or other information useful for follow-on attacks. The Preview Pane attack path increases concern because malicious content may be processed during ordinary email review.

WORKAROUND: No specific workaround is confirmed in the available data. Microsoft identifies an official fix as the remediation. Organizations should deploy available Outlook security updates and apply the corresponding updates for Microsoft Office LTSC for Mac 2021 and 2024 once they become available.

URGENCY: This vulnerability is rated Critical and can be targeted remotely without requiring attacker privileges. Although Microsoft reports no active exploitation and assesses exploitation as less likely, the Outlook Preview Pane is a confirmed attack vector and successful exploitation could expose sensitive heap memory. Organizations should prioritize patching affected Outlook installations, particularly systems that routinely process untrusted external email.