Microsoft Office Outlook: Remote code execution due to invalid pointer reference
Summary
Microsoft Office Outlook contains a remote code execution vulnerability caused by the release of an invalid pointer or reference (CWE-763). According to the CVE record, an unauthenticated attacker can execute code over a network, provided a user interacts with a crafted message; the CVSS 3.1 base score is 8.8. Microsoft fixed the flaw in the November 2026 Patch Tuesday updates. At the time of research it was not marked as exploited in the wild and no public proof of concept was found.
Affected
- Microsoft 365 Apps for Enterprise: 16.0.1 up to the build listed at aka.ms/OfficeSecurityReleases (exact fixed build unknown)
- Office LTSC 2021: versions before 16.0.14334.21048
- Office LTSC 2024: versions before 16.0.17932.21140
- Mac editions are not listed for this CVE in the CVE record
Fixed in
- Office LTSC 2021: 16.0.14334.21048 or later
- Office LTSC 2024: 16.0.17932.21140 or later
- Microsoft 365 Apps for Enterprise: current build from the November 2026 updates (exact build unknown)
Workaround
- No workaround is known. Install the November 2026 security updates.
- Unknown: whether the MSRC advisory describes interim mitigations.
Exploitation
- Not marked as exploited in the wild at the time of research.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- KEV status not verified against the CISA catalogue (one source lists it as not listed).
- No public proof of concept found.
- Not to be confused with CVE-2026-124194, a separate Outlook spoofing flaw from the same release that Microsoft reports as exploited.
Our recommendation
- Install the November 2026 updates for Microsoft 365 Apps and Office LTSC on all Outlook clients without delay.
- Check the installed Microsoft 365 build against the aka.ms/OfficeSecurityReleases page.
- Make sure users do not open or preview unexpected messages from unknown senders until patched.
- Monitor the MSRC advisory and CISA KEV for changes in exploitation status.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center advisory msrc.microsoft.com
- CVE Record CVE-2026-111309 www.cve.org
- Strix CVE-2026-111309 www.strix.ai
- Qualys Patch Tuesday review November 2026 blog.qualys.com
- Cybersecurity News: Microsoft November 2026 Patch Tuesday cybersecuritynews.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:03.
Original description (NVD)
Release of invalid pointer or reference in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.