CVE-2026-97749 – Microsoft Office Outlook Remote Code Execution Vulnerability

A critical Remote Code Execution (RCE) vulnerability has been identified in Microsoft Office Outlook that could allow an unauthenticated attacker to execute malicious code on a targeted computer. The vulnerability, caused by a double-free memory management flaw, can be triggered when a user simply views a specially crafted email in the Outlook Reading Pane. No clicks, attachments, or additional user interaction are required. Successful exploitation could allow attackers to compromise affected systems, access sensitive information, and disrupt business operations. Microsoft has classified this vulnerability as Critical, with a CVSS score of 9.8.

CVSS SCORE: 9.8

SEVERITY: Critical

Threat

This vulnerability presents a serious security threat because attackers can potentially compromise a system through a specially crafted email without requiring authentication or user interaction.

An attacker could send a malicious email to a targeted employee, and simply displaying that message in the Outlook Reading Pane could trigger the vulnerability.

The vulnerability has a low attack complexity and can be exploited over a network, making it particularly concerning for organizations that rely heavily on Outlook for daily communications.

Successful exploitation could compromise the confidentiality, integrity, and availability of affected systems.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

• Publicly Disclosed: No
• Actively Exploited: No
• Exploit Code Maturity: Unproven
• Proof-of-Concept (PoC): No confirmed public PoC information.
• Zero-Day Exploitation: No confirmed zero-day exploitation.

Although there are no confirmed reports of active exploitation, the vulnerability remains dangerous because attackers could potentially exploit it using a specially crafted email.

The combination of network-based exploitation, low attack complexity, and no required user interaction makes this vulnerability a significant security concern.

Technical Summary

CVE-2026-97749 is a critical Remote Code Execution vulnerability affecting Microsoft Office Outlook.

The vulnerability originates from a Double Free (CWE-415) memory management weakness.

A double-free vulnerability occurs when an application attempts to release the same memory location more than once. This can corrupt memory management structures and potentially allow an attacker to execute malicious code.

In this case, an attacker could exploit the vulnerability by sending a specially crafted email message to a targeted Outlook user.

The attack does not require the recipient to open attachments, click links, or interact with the email.

Simply displaying the malicious message in the Outlook Reading Pane could trigger the vulnerability.

Successful exploitation could allow an unauthorized attacker to execute code on the affected computer.

The vulnerability has the following technical characteristics:

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

These characteristics indicate that successful exploitation could significantly affect the security and reliability of vulnerable systems.

Exploitability

The vulnerability affects the following Microsoft products:

• Microsoft 365 Apps for Enterprise – 32-bit and 64-bit systems
• Microsoft Office LTSC 2021 – 32-bit and 64-bit editions
• Microsoft Office LTSC 2024 – 32-bit and 64-bit editions

An attacker could exploit the vulnerability remotely by sending a specially crafted email that triggers the double-free condition when displayed in Outlook’s Reading Pane.

No authentication, special privileges, or user interaction are required.

Microsoft currently assesses successful exploitation as less likely.

Business Impact

This vulnerability poses a significant risk to organizations because Microsoft Outlook is widely used for business communications.

A successful attack could allow malicious code to execute on an employee’s computer, potentially compromising sensitive corporate information and disrupting business operations.

Potential consequences include:

• Sensitive Data Exposure: Attackers could potentially access confidential emails, business documents, and other sensitive information.
• System Compromise: Successful remote code execution could allow attackers to run malicious software on affected computers.
• Business Disruption: Compromised systems could experience service interruptions, affecting employee productivity and daily operations.
• Financial and Reputational Damage: Security incidents involving confidential information could result in financial losses, investigation costs, and damage to customer trust.

The biggest concern is that an ordinary email could become an entry point for a serious security incident, without employees taking any action.

Organizations with large Outlook deployments could face widespread exposure if affected systems remain unpatched.

Workaround

Microsoft has not identified any official mitigations or workarounds for this vulnerability.

Organizations should prioritize deploying the official security update.

Until patching is completed, organizations may consider additional email security monitoring and controls to reduce exposure, although these measures are not confirmed workarounds.

Urgency

Critical – Prioritize Immediate Patching

CVE-2026-97749 carries a critical CVSS score of 9.8 and presents a serious remote code execution risk.

The vulnerability is particularly concerning because exploitation requires no authentication and no user interaction.

An attacker could potentially compromise an affected computer simply by sending a malicious email that is displayed in Outlook’s Reading Pane.

Although Microsoft currently considers exploitation less likely and has not reported active exploitation, the potential impact remains severe.

Organizations should prioritize deploying the official Microsoft security update across affected Microsoft 365 Apps and Office LTSC installations.

Delaying this patch could leave business systems exposed to an attack where simply viewing an email is enough to trigger malicious code execution.