CVE-2026-78525 – Microsoft Office Outlook Remote Code Execution Vulnerability

CVE-2026-78525 is a Critical remote code execution vulnerability caused by a use-after-free weakness (CWE-416) in Microsoft Office Outlook. An unauthorized attacker can send a specially crafted email, and exploitation may occur when the victim opens the email using an affected Outlook version or when Outlook displays its preview. Successful exploitation could allow the attacker to execute remote code on the victim’s machine.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: A specially crafted email can expose affected systems to remote code execution. The email-based attack path is particularly significant because displaying a malicious message in Outlook’s preview may be sufficient to trigger exploitation.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Its exploitability assessment is “Exploitation Less Likely.” No public exploit, zero-day exploitation, or proof-of-concept exploit code is confirmed.

TECHNICAL SUMMARY: The vulnerability is a use-after-free weakness (CWE-416) in Microsoft Office Outlook. A use-after-free condition involves software incorrectly using memory after it has been released. In the documented email attack scenario, an unauthorized attacker sends a specially crafted email to a victim. Exploitation might occur when the victim opens that email with an affected version of Microsoft Outlook or when Outlook displays a preview of the crafted message. Successful exploitation can result in remote code execution on the victim’s machine.

EXPLOITABILITY: Affected software listed includes Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office 2019 (32-bit and 64-bit), Microsoft Office LTSC 2021 (32-bit and 64-bit), Microsoft Office LTSC 2024 (32-bit and 64-bit), and Microsoft Word 2016 (32-bit and 64-bit). The attack can involve opening or previewing a specially crafted email. More specific affected Outlook versions cannot be confirmed from the source data.

BUSINESS IMPACT: Successful exploitation could allow remote code execution on a victim’s machine, creating a serious risk to affected organizational endpoints. A malicious email could become the entry point for executing attacker-controlled code, with potential consequences for the systems and information accessible from the compromised machine.

WORKAROUND: No workaround or mitigation is specified in the source data. Where the patch cannot be applied, no alternative mitigation can be confirmed without adding information absent from the source.

URGENCY: This vulnerability carries a Critical severity rating and can lead to remote code execution through a specially crafted email. Although exploitation is assessed as less likely and no active exploitation is reported, affected Microsoft Office deployments should be prioritized for patching because opening or previewing malicious email may result in attacker-controlled code executing on a victim’s machine.