Microsoft Office Outlook: Remote code execution via uninitialized resource
Summary
Microsoft Office Outlook contains a use of uninitialized resource flaw (CWE-908) that allows an unauthorized attacker to execute code over the network. The CVSS vector indicates high attack complexity and required user interaction, so the victim probably has to act, for example by opening a crafted message or file; the record does not describe the exact trigger. A successful attack would give the attacker full control over confidentiality, integrity and availability on the affected system. The fix is delivered through Office security updates, not through the Windows cumulative update alone.
Affected
- Microsoft 365 Apps for Enterprise from 16.0.1 before the build listed on https://aka.ms/OfficeSecurityReleases (build number not confirmed)
- Office LTSC 2021 from 16.0.1 before 16.0.14334.21048
- Office LTSC 2024 from 16.0.0 before 16.0.17932.21140
Fixed in
- Office security update released on 10 November 2026 for Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024
- Minimum fixed builds per the CNA record: LTSC 2021 16.0.14334.21048, LTSC 2024 16.0.17932.21140
- Unknown: exact fixed build for Microsoft 365 Apps for Enterprise; check the Office security release notes
- The Windows cumulative update alone does not address this Outlook vulnerability
Workaround
Unknown. No vendor-published workaround was found; patching is the remediation.
Exploitation
- Not marked as exploited in the wild at the time of research
- Public proof of concept: unknown
- NVD status is Awaiting Analysis; NVD scoring and CISA KEV status are not yet confirmed
- Do not confuse with CVE-2026-124194, a separate Outlook spoofing flaw that is marked as actively exploited
Our recommendation
- Deploy the November 2026 Office security update to all Outlook and Office clients without delay
- Confirm the installed Office build on each endpoint against the MSRC build list, and do not rely on the Windows update alone
- Restrict or review handling of unsolicited emails and attachments until patching is complete
- Re-check this CVE once NVD analysis and the MSRC build list are available
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-124227 msrc.microsoft.com
- CVE Record: CVE-2026-124227 www.cve.org
- Cybersecurity News: November 2026 Patch Tuesday cybersecuritynews.com
- CyberInsider: Microsoft November 2026 Patch Tuesday Outlook zero-day cyberinsider.com
- The Tech Hacker: November 2026 Patch Tuesday Outlook zero-day thetechhacker.com
- EUVD-2026-73825 (possibly related record, verify) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:15.
Original description (NVD)
Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.