Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Microsoft Outlook may run malicious code remotely

CVE-2026-88156 · published 22 days ago
Summary

Outlook on Windows and Mac can be tricked into executing harmful programs when it receives specially crafted messages, allowing an attacker to take control of the system. This could lead to data loss, unauthorized access, or further spread of malware. Apply the latest Microsoft updates for Office and Outlook and use email filtering to reduce the risk.

What to do
  • Update microsoft microsoft office ltsc 2021 to version 16.0.14334.20974 or later.
  • Update microsoft microsoft office ltsc 2024 to version 16.0.17932.21056 or later.
Affected software
VendorProductAffected versions
microsoft microsoft 365 apps for enterprise 16.0.1
microsoft microsoft office 365 for mac < publication
< 16.114.26101123
microsoft microsoft office ltsc 2021 < 16.0.14334.20974
microsoft microsoft office ltsc 2024 < 16.0.17932.21056
microsoft microsoft office ltsc for mac 2021 < publication
< 16.114.26101123
microsoft microsoft office ltsc for mac 2024 < publication
< 16.114.26101123
microsoft 365_apps All versions
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*
microsoft microsoft_365 All versions
cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*
microsoft office_2021 All versions
cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*
microsoft office_2024 All versions
cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*
Original advisory text
Microsoft Office Outlook Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published13 Oct 2026
Updated31 Oct 2026
First seen13 Oct 2026
Sources
CVE-2026-88156 · NVD
CVE-2026-88156 · MITRE
Track software like this
Free during beta