Microsoft Office Outlook: Heap-based buffer overflow enabling code execution
Summary
A heap-based buffer overflow in Microsoft Office Outlook, delivered through Microsoft 365 Apps and Office LTSC, allows an unauthorized attacker to execute code over a network. According to the CVSS vector, exploitation requires user interaction (UI:R) and no privileges, and the impact on confidentiality, integrity and availability is rated high (CVSS 8.8). Microsoft rates the CVE below the critical Outlook vulnerabilities of the same October 2026 update batch, and no public exploitation has been reported.
Affected
- Microsoft 365 Apps for Enterprise: 16.0.1 up to the fixed build (exact fixed build unverified)
- Office LTSC 2021: 16.0.1 up to 16.0.14334.20974
- Office LTSC 2024: 16.0.0 up to 16.0.17932.21056
Fixed in
- Microsoft 365 Apps for Enterprise: Unknown. Check the Microsoft Security Update Guide for the fixed build.
- Office LTSC 2021: 16.0.14334.20974 (per official CVE record; not independently verified)
- Office LTSC 2024: 16.0.17932.21056 (per official CVE record; not independently verified)
Workaround
Unknown. No published workaround. Applying the security update is the mitigation.
Exploitation
- Not publicly disclosed and not known to be exploited, according to Microsoft as reported by third parties
- Microsoft exploitability rating: Exploitation Less Likely
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
Our recommendation
- Install the October 2026 Microsoft 365 and Office updates on all Outlook clients, starting with the LTSC builds listed above.
- Verify the installed Microsoft 365 Apps build against the MSRC advisory, because the fixed build for this product is not confirmed here.
- Check which Office versions are still supported; Outlook 2016 and 2019 reportedly received no October 2026 security updates, so plan an upgrade.
- Filter untrusted attachments and suspicious emails at the mail gateway and train users to avoid unexpected messages.
- Monitor for unusual Outlook process activity until all clients are patched.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-70257 msrc.microsoft.com
- Robert 365: Latest updates for classic Outlook robert365.com
- Vulners: CISA Vulnrichment CVE-2026-70257 vulners.com
- Strix: CVE-2026-70257 www.strix.ai
- Office-watch: October 2026 Patch Tuesday Office critical fixes office-watch.com
- Cyberexperts: Patch Tuesday October 2026 cyberexperts.com
- OpenCVE: CVE-2026-70257 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:48.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.