Introduction
Microsoft's November 10, 2026 Patch Tuesday release fixed a heap buffer overflow in Microsoft Office Outlook that can lead to code execution when a user selects a crafted email for display in the Preview Pane. The trigger is message preview, not opening an attachment or enabling macros, so the exposure maps directly onto routine mail handling for organizations running Microsoft 365 Apps for Enterprise and Office LTSC 2021 or 2024.
The initial data we received listed the vendor as Unknown. NVD records Microsoft as the source ([email protected]), Microsoft is the assigning CNA, and the affected product records are all Microsoft Office products, so we treat Microsoft as the vendor throughout.
Technical information
Root cause
CVE-2026-110043 is classified as CWE-122, Heap-based Buffer Overflow. MITRE defines this class as a buffer overflow in which the overwritten buffer is allocated on the heap. Typical consequences for the class include crashes, corruption of adjacent heap memory, and arbitrary code execution. Those consequences describe the weakness class in general and say nothing specific about Outlook internals.
Microsoft has not published the vulnerable function, the parser involved, the allocation size, the overwrite layout, or how a payload would be constructed. Outlook is closed source and no vulnerable code has been released, so we are not showing any snippets here. Microsoft does provide a concrete attack scenario and the CVSS characterization.
Attack flow
Based on Microsoft's advisory, the documented sequence is:
- The attacker constructs a specially crafted email and delivers it to the target mailbox. No account or prior privileges on the target system are needed.
- The user selects the message for display in the Outlook Preview Pane. Microsoft explicitly confirms that the Preview Pane is an attack vector.
- Processing the crafted message triggers the heap overflow described by the CWE classification.
- Successful exploitation executes code with the permissions of the logged-on user.
The disclosure sets these boundaries:
- User interaction is required. Receipt alone is not the published trigger, and the user has to select the message for preview.
- No attachment, macro, or credential step is part of the disclosed scenario. The relevant action is previewing the message.
- Impact is bounded by the user's permissions. The disclosure does not establish administrator-level or SYSTEM-level execution, and no privilege escalation chain is described.
CVSS characterization
Microsoft's base vector, as recorded in NVD:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Confidentiality, Integrity, Availability: High
This yields a base score of 8.8 (High). Separately, Microsoft's advisory lists Critical as the maximum severity. The two come from different rating systems that answer different questions, so they do not conflict. Microsoft also publishes a temporal score of 7.7, reflecting Exploit Code Maturity: Unproven, Remediation Level: Official Fix, and Report Confidence: Confirmed. Temporal values change over time and should not replace the 8.8 base score when reporting severity.
Exploitation status
As of the November 10, 2026 advisory, Microsoft lists:
- Exploited: No
- Publicly disclosed: No
- Exploitability assessment: Exploitation Less Likely
The CISA Known Exploited Vulnerabilities feed we reviewed (catalog version 2026.11.10) does not list this CVE. However, that feed was released at 19:03:29Z on November 10, about fifteen minutes before NVD published this CVE at 19:18:20, so it cannot tell us anything about later additions. The same feed does contain a different Outlook entry, CVE-2026-124194, and press coverage of a November 2026 Outlook zero day refers to a separate issue. Neither should be conflated with CVE-2026-110043. No threat actor, campaign, public exploit, or indicators of compromise have been tied to this vulnerability in the sources we reviewed.
Patch information
Microsoft fixed CVE-2026-110043 in its November 10, 2026 Patch Tuesday release. The MSRC advisory sets Remediation Level to Official Fix (RL:O), which Microsoft defines as "A complete vendor solution is available." That metric is part of why the score drops from a base of 8.8 to a temporal score of 7.7.
What the patch is
There is no commit, diff, or source-level changelog. The fix ships as updated Office binaries through Microsoft's Click to Run servicing. The cumulative Office build replaces the vulnerable Outlook component in one step, and there is no separate Outlook-only package. Microsoft has not described the code change. Fixes for CWE-122 bugs usually add checks so that a length or size derived from untrusted input cannot push a write past the end of a heap buffer, and here the untrusted input is a crafted email rendered in the Preview Pane. Treat that as our inference from the bug class, not a confirmed description of the change.
Fixed builds (MSRC Security Updates table, 32 bit and 64 bit)
- Microsoft Office LTSC 2024:
16.0.17932.21140 - Microsoft Office LTSC 2021:
16.0.14334.21048 - Microsoft 365 Apps for Enterprise: per-channel builds, see Office Security Releases
Microsoft 365 Apps channel builds
Microsoft's Release notes for Microsoft Office security updates, updated November 10, 2026, lists CVE-2026-110043 under its Outlook section with these November builds:
- Current Channel: Version 2610, Build 20527.20196
- Monthly Enterprise Channel: Version 2610, Build 20527.20194; Version 2609, Build 20430.20264; Version 2608, Build 20326.20320
- Semi Annual Enterprise Channel: Version 2610, Build 20527.20192; Version 2609, Build 20430.20262; Version 2608, Build 20326.20318
- Office 2024 / 2021 Retail: Version 2610, Build 20527.20196
The same page lists a November build for Office 2019 Volume Licensed (1808, Build 10417.20236), but Office 2019 is not in the MSRC affected product table for this CVE. Check your channel against the live release notes before rollout, since Microsoft sometimes revises builds after release day.
Deploying the update
For individual installations, Microsoft Support documents this procedure:
- Open an Office application, such as Word, and create a new document.
- Select File > Account, or Office Account in Classic Outlook.
- Under Product Information, select Update Options > Update Now (select Enable Updates first if needed).
If Update Options is missing, the installation is likely volume licensed or centrally managed. For managed fleets, Microsoft documents configuring update paths, automatic updates, and deadlines through the Office Deployment Tool or Group Policy. Microsoft has not published a CVE-specific workaround, registry change, or Preview Pane setting as a vendor-endorsed mitigation for this issue.
Confirming the fix
In Outlook, go to File > Office Account > About Outlook and compare the full version string (for example, 16.0.14334.21048) with the builds above. A build equal to or higher than the listed one for your product and channel means the November security update is installed.
Affected systems and versions
Per the CVE record and NVD (data supplied by Microsoft), all of the following apply to 32-bit and x64-based systems:
- Microsoft 365 Apps for Enterprise: affected from
16.0.1. The upper boundary is defined per channel via the Office Security Releases resource rather than a single build. - Microsoft Office LTSC 2021: affected from
16.0.1up to, but not including,16.0.14334.21048. - Microsoft Office LTSC 2024: affected from
16.0.0up to, but not including,16.0.17932.21140.
Any LTSC build at or above those boundaries is patched. Office 2019 is not listed as affected by MSRC for this CVE.
Vendor security history
The Cyber Safety Review Board's review of the summer 2023 Exchange Online intrusion attributed that operation to Storm-0558, an actor affiliated with the People's Republic of China, and concluded the intrusion was preventable. The Board described a cascade of Microsoft errors, including an older signing key that would not have remained valid in 2023 had Microsoft maintained manual rotation, completed automatic rotation, and implemented aging key alerts. It judged Microsoft's security culture inadequate and called for accountability starting with senior leadership.
Microsoft responded with the Secure Future Initiative, launched in November 2023 around secure by design, secure by default, and secure operations. Its July 2026 progress report describes strengthened cryptographic safeguards, reduced legacy authentication exposure, and phishing-resistant defaults rolled out at scale. These are company-reported results, not independent validation, and they do not remediate this Outlook overflow.
The 2023 incident is separate history. Nothing we reviewed connects Storm-0558 to CVE-2026-110043.
References
- NVD: CVE-2026-110043
- CVE Record: CVE-2026-110043
- Microsoft Security Update Guide: CVE-2026-110043
- Release notes for Microsoft Office security updates
- Office Security Releases
- NVD API record for CVE-2026-110043
- CWE-122: Heap-based Buffer Overflow
- CVSS v3.1 Specification Document
- How to update Microsoft 365 or Office for Windows
- Keep Office apps up to date with the latest updates
- CISA Known Exploited Vulnerabilities feed
- BleepingComputer: Microsoft November 2026 Patch Tuesday coverage (refers to a different Outlook zero day)
- CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft Secure Future Initiative
- Microsoft Secure Future Initiative overview (Microsoft Learn)
- SFI Progress Report July 2026
- Microsoft named a Leader in the 2025 Gartner Magic Quadrant for Email Security
