Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-97016: Outlook may let attackers run code remotely

CVE-2026-97016 · published 22 days ago

Summary

Microsoft Outlook in Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 has a flaw that could let an outside attacker make the program execute their own code over the network. This could give the attacker control of the affected computer or access to sensitive information. Install the latest Microsoft security updates as soon as they are available to protect your system.

What to do

Update microsoft microsoft office ltsc 2021 to version 16.0.14334.20974 or later.
Update microsoft microsoft office ltsc 2024 to version 16.0.17932.21056 or later.

Affected software

Vendor	Product	Affected versions
microsoft	microsoft 365 apps for enterprise	16.0.1
microsoft	microsoft office ltsc 2021	< 16.0.14334.20974
microsoft	microsoft office ltsc 2024	< 16.0.17932.21056
microsoft	365_apps	All versions `cpe:2.3:a:microsoft:365_apps:-::::enterprise::x64:*`
microsoft	office_2021	All versions `cpe:2.3:a:microsoft:office_2021:-::::ltsc:-:x64:`
microsoft	office_2024	All versions `cpe:2.3:a:microsoft:office_2024:-::::ltsc:-:x64:`

Original advisory text

Microsoft Office Outlook Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97016 vendor-advisory patch

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

1% chance of attack within 30 days

Type

CWE-122Heap-based Buffer Overflow

Timeline

Published13 Oct 2026

Updated31 Oct 2026

First seen13 Oct 2026

Sources

CVE-2026-97016 · NVD

CVE-2026-97016 · MITRE

Track software like this

Free during beta