Microsoft Office Outlook: Remote code execution via heap-based buffer overflow
Summary
A heap-based buffer overflow in Microsoft Office Outlook allows an unauthenticated remote attacker to execute code on the affected system. According to Microsoft's CVE record, the attack requires no privileges and no user interaction, and Microsoft lists the Reading Pane as the trigger vector, so a crafted email may be sufficient. The CVSS base score is 9.8 (Critical). Microsoft has released security updates; no exploitation has been reported so far.
Affected
- Microsoft 365 Apps for Enterprise (32-bit and 64-bit; exact version range per MSRC advisory)
- Microsoft Office LTSC 2021 (32-bit and 64-bit): versions 16.0.1 up to but excluding 16.0.14334.20974 (per CVE record)
- Microsoft Office LTSC 2024 (32-bit and 64-bit): versions 16.0.0 up to but excluding 16.0.17932.21056 (per CVE record)
- Standalone Office 2019, Office 2016 and Outlook for Mac: Unknown.
Fixed in
- Security updates released on October 13, 2026 (Microsoft Patch Tuesday).
- Microsoft 365 Apps: Unknown (check the MSRC advisory for the fixed build).
- Office LTSC 2021: 16.0.14334.20974 or later.
- Office LTSC 2024: 16.0.17932.21056 or later.
Workaround
- No workaround documented by Microsoft. Unknown.
- Consider disabling the Outlook Reading Pane and preview via Group Policy until patching is complete; this is an analyst recommendation and not validated for this CVE.
Exploitation
- Microsoft rates exploitation as less likely; no exploitation reported so far.
- CISA SSVC: exploitation none, automatable yes.
- Not listed in CISA KEV. EPSS about 0.016.
- No public proof of concept found.
Our recommendation
- Install the October 2026 Microsoft Office security updates on all Outlook desktop installations as a priority.
- Verify the deployed build of Microsoft 365 Apps and Office LTSC 2021/2024, especially on machines not managed by Microsoft Update.
- Check the MSRC advisory for the exact fixed builds and any mitigations.
- Monitor for exploitation reports and recheck the NVD status before closing the ticket.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-70242 msrc.microsoft.com
- Microsoft Security Advisory CVE-2026-70242 msrc.microsoft.com
- Vicarius: Microsoft October 2026 Patch Tuesday www.vicarius.io
- Automox: Patch Tuesday October 2026 www.automox.com
- CVEFeed: CVE-2026-70242 cvefeed.io
- Vulners: NVD:CVE-2026-70242 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:44.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.