Microsoft Office Outlook: Remote code execution via heap-based buffer overflow
Summary
Microsoft Office Outlook contains a heap-based buffer overflow (CWE-122, CWE-190) that allows an unauthenticated remote attacker to execute code. Exploitation requires that a user performs an action, such as opening a crafted message or file; the exact user action is not described in the sources. The CVSS score is 8.8 (High), and no public proof of concept or exploitation in the wild is known.
Affected
- Microsoft 365 Apps for Enterprise: 16.0.1 up to the fixed build (exact build unknown)
- Microsoft Office LTSC 2021: 16.0.1 before 16.0.14334.21048
- Microsoft Office LTSC 2024: 16.0.0 before 16.0.17932.21140
Fixed in
- Microsoft Office LTSC 2021: 16.0.14334.21048 and later
- Microsoft Office LTSC 2024: 16.0.17932.21140 and later
- Microsoft 365 Apps for Enterprise: Unknown. Check the MSRC Security Update Guide for the fixed build.
Workaround
Unknown. No workaround or mitigation was found in the sources.
Exploitation
- Exploited in the wild: No evidence known (CISA KEV: not listed according to research notes)
- Public proof of concept: None found
- CVSS temporal vector includes E:U (exploit code maturity unproven)
Our recommendation
- Install the November 2026 security updates for Microsoft 365 Apps and Office LTSC 2021/2024 as soon as possible.
- Confirm the fixed Microsoft 365 build in the MSRC Security Update Guide.
- Warn users about messages and attachments from unknown senders and about unexpected files.
- Monitor the NVD and MSRC entries for updates on exploitation status.
- Note that CVE-2026-124194 is a different Outlook zero-day that is actively exploited; patch it as well.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-123377 msrc.microsoft.com
- CVE Record: CVE-2026-123377 www.cve.org
- Strix: CVE-2026-123377 www.strix.ai
- Offseq: November 2026 Patch Tuesday radar.offseq.com
- ITSecurityNews: Exploited Outlook zero-day among 1094 flaws patched www.itsecuritynews.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:17.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.