IT SBIT Services
Schneeberger
DEEN
CVE tracker

Office Outlook: Remote code execution due to heap-based buffer overflow

CVE-2026-97016Critical 9.8

← All vulnerabilities

Summary

A heap-based buffer overflow in Microsoft Office Outlook allows an unauthenticated attacker to execute code over the network, with a CVSS 3.1 base score of 9.8 (critical). Microsoft's advisory and the research notes indicate that a crafted email, processed through the preview pane, may be enough to trigger it without a click. The NVD record was still awaiting analysis in the sources reviewed, so the official scoring should be verified.

Affected

  • Microsoft 365 Apps for Enterprise (32-bit and x64), Click-to-Run builds from 16.0.1 up to the October 2026 security update. Exact fixed build: Unknown.
  • Microsoft Office LTSC 2021 (32-bit and x64): below 16.0.14334.20974 according to a third-party aggregator, not verified against Microsoft.
  • Microsoft Office LTSC 2024 (32-bit and x64): below 16.0.17932.21056 according to a third-party aggregator, not verified against Microsoft.

Fixed in

  • Microsoft's October 2026 security update for Microsoft 365 Apps and Office LTSC 2021/2024.
  • Exact patched build numbers per product: Unknown. Check the MSRC advisory and Microsoft's release notes.

Workaround

  • No Outlook-specific workaround was found in the sources reviewed.
  • Interim measure (recommendation, not from a source): restrict or disable the Outlook preview pane for high-risk mailboxes until patched.
  • Filter inbound mail for suspicious attachments and links.

Exploitation

  • No evidence of exploitation in the wild for this CVE was found.
  • CISA SSVC data: exploitation none, automatable yes. Rapid7 rates it Exploitation Less Likely and reports it is not in CISA KEV.
  • Public proof of concept: none found.
  • Talos reports that one vulnerability in the October 2026 release was exploited but does not name it in the text reviewed. Check the MSRC release notes.

Our recommendation

  • Install the October 2026 security update on all Microsoft 365 Apps and Office LTSC 2021/2024 clients with Outlook, and confirm the installed build numbers against the MSRC advisory.
  • Until patched, restrict or disable the Outlook preview pane for high-risk mailboxes and filter inbound mail.
  • Monitor for signs of exploitation and for updates to the exploitation status of this CVE.

Information from Microsoft (Patch Tuesday October 2026)

Severity (Microsoft)
Critical
Impact
Remote code execution – Microsoft Office Outlook
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Microsoft Office

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:13.

Original description (NVD)

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed