Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-88156: Microsoft Outlook may run malicious code remotely
CVE-2026-88156 · published today
Summary
Outlook on Windows and Mac can be tricked into executing harmful programs when it receives specially crafted messages, allowing an attacker to take control of the system. This could lead to data loss, unauthorized access, or further spread of malware. Apply the latest Microsoft updates for Office and Outlook and use email filtering to reduce the risk.
What to do
- Update microsoft microsoft office 365 for mac to version publication or later.
- Update microsoft microsoft office ltsc 2021 to version 16.0.14334.20974 or later.
- Update microsoft microsoft office ltsc 2024 to version 16.0.17932.21056 or later.
- Update microsoft microsoft office ltsc for mac 2021 to version publication or later.
- Update microsoft microsoft office ltsc for mac 2024 to version publication or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | microsoft 365 apps for enterprise | 16.0.1 |
| microsoft | microsoft office 365 for mac | < publication |
| microsoft | microsoft office ltsc 2021 | < 16.0.14334.20974 |
| microsoft | microsoft office ltsc 2024 | < 16.0.17932.21056 |
| microsoft | microsoft office ltsc for mac 2021 | < publication |
| microsoft | microsoft office ltsc for mac 2024 | < publication |
Original advisory text
Microsoft Office Outlook Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published13 Oct 2026
Updated14 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta