Brief Summary: Microsoft Outlook CVE-2026-111309 Invalid Pointer Release Enables Remote Code Execution via Preview Pane

Introduction

Microsoft's November 2026 security release fixed a Critical remote code execution flaw in Outlook that is reachable when a user simply previews a crafted email. Because Microsoft explicitly names the Preview Pane as an attack vector, the "user interaction required" element of the CVSS vector offers less practical protection than it suggests, and every affected Outlook installation needs to reach a fixed Office build.

Technical information

Root cause: CWE 763, Release of Invalid Pointer or Reference

Microsoft classifies CVE-2026-111309 as CWE 763, Release of Invalid Pointer or Reference. MITRE defines this weakness as attempting to return a memory resource using the wrong release function, or using the appropriate release function incorrectly. Concretely, it happens when code frees memory with a pointer the allocator never handed out or no longer owns, for example:

a pointer into the middle of a buffer rather than its base address
a pointer to the wrong object type
a pointer that was already released

MITRE's documented consequences include memory corruption, crashes, and potentially arbitrary code execution when an attacker can effectively control the corrupted memory.

Microsoft states that the bug is reached when a user opens or previews a specially crafted email. That places the faulty release inside the code paths Outlook runs while parsing or rendering message content. If attacker-supplied content influences what gets freed, the heap can be corrupted and code can run on the victim's machine.

Much is still unknown. Office is closed source, and Microsoft has published no diff, commit, or root-cause write-up. The available material does not identify the vulnerable function, the email field or message encoding involved, a heap manipulation technique, or the execution control primitive. The CWE classification explains the class of memory management failure. It does not identify the exact Outlook defect. No vulnerable code has been published, so we do not reproduce any here.

Attack flow

Based on Microsoft's documented scenario, exploitation proceeds as follows:

The attacker builds a specially crafted email and sends it to the target. No existing account, privileges, or access to the target's settings or files is required.
The target opens the message, or merely views it in the Preview Pane, in an affected Outlook version. Microsoft explicitly answers that the Preview Pane is an attack vector.
While Outlook processes the message content, the invalid pointer release occurs, corrupting memory.
If the attacker can control the corrupted memory, this results in remote code execution on the victim's machine.

Two boundaries matter. First, Microsoft does not describe exploitation from delivery of an unread message alone. An open or preview is required. Second, the advisory does not establish execution as SYSTEM, administrator-level compromise, or a follow-on privilege escalation. Microsoft documents this as an exploitation scenario and does not describe an observed incident.

CVSS assessment

Microsoft rates the vulnerability Critical under its own severity system, while the CVSS v3.1 base score is 8.8 (High). The two ratings come from separate classification schemes and do not conflict.

Base (8.8):     CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal (7.7): CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Attack Vector: Network, a remote attack path via email.
Attack Complexity: Low in the published assessment.
Privileges Required: None, no prior attacker authorization.
User Interaction: Required, satisfied by opening or previewing the message.
Scope: Unchanged.
Confidentiality, Integrity, Availability: High for each.
Temporal modifiers: Exploit Code Maturity Unproven (E:U), Remediation Level Official Fix (RL:O), Report Confidence Confirmed (RC:C).

The Preview Pane detail is more operationally specific than the UI:R label. In practice, a user scrolling through their inbox with the reading pane enabled satisfies the interaction requirement.

Exploitation status at release

Microsoft's exploitability assessment, made at original publication, records the vulnerability as not publicly disclosed and not exploited, rates it Exploitation Less Likely, and gives its exploit code maturity as Unproven. No threat actor, campaign, or victim is identified for this CVE. The acknowledgement credits yhw, which is a research credit rather than attribution of malicious activity. The sources we reviewed do not establish KEV membership.

November 2026 Patch Tuesday coverage did discuss an actively exploited Outlook zero day, but that was a different bug: CVE-2026-124194, a spoofing vulnerability in which a crafted message file causes Outlook to contact an attacker-controlled network location without the usual external content warning, potentially exposing authentication information. That exploitation context should not be applied to CVE-2026-111309. The two do share a remedy, since the same November build fixes both.

Patch information

Status: official vendor fix, shipped November 10, 2026, in Microsoft's November 2026 security release (2026-Nov). In Microsoft's Security Update Guide data, all six affected product and architecture entries show productStatus: "fixed" and customerActionRequired: true. The temporal vector's RL:O confirms a complete vendor patch exists. Nothing is fixed server side. The update must be installed on each client.

Fixed builds

These are Microsoft's minimum fixed versions. Any build below them is vulnerable.

Microsoft Office LTSC 2021 (x86, x64): vulnerable from 16.0.1 up to but not including 16.0.14334.21048. Fixed in 16.0.14334.21048 (Version 2108).
Microsoft Office LTSC 2024 (x86, x64): vulnerable from 16.0.0 up to but not including 16.0.17932.21140. Fixed in 16.0.17932.21140 (Version 2408).
Microsoft 365 Apps for Enterprise (x86, x64): vulnerable from 16.0.1 up to the per-channel fixed builds below (see Office Security Releases).

Microsoft's Office security release notes list CVE-2026-111309 under Outlook in the November 10, 2026 release, delivered in these builds:

Current Channel: Version 2610 (Build 20527.20196)
Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
Semi Annual Enterprise Channel (receives Monthly Enterprise Channel builds): Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
Office 2024 Retail and Office 2021 Retail: Version 2610 (Build 20527.20196)

The October 13, 2026 builds immediately preceded the fix: LTSC 2024 Build 17932.21056 and LTSC 2021 Build 14334.20974. Anything at or below those still has the flaw.

How the fix is delivered and verified

There is no standalone hotfix or KB package. The fix ships through Office's normal Click to Run servicing. Microsoft's advisory lists a "Security Update" pointing to the Office security release notes and names no individual patched binaries (affectedBinaries: []). Verify by build number rather than file version. A machine is patched once the version shown under File > Office Account > About in Outlook meets or exceeds the fixed build for its product or channel.

The November build also fixes other Outlook CVEs in the same release, including CVE-2026-110043 and CVE-2026-124194, so one update addresses all of them.

For individual Microsoft 365 or Office installations, Microsoft documents this update procedure:

Open an Office application and select File > Account (or Office Account in Classic Outlook).
Under Product Information, select Update Options > Update Now.
If Update Now is not shown, select Enable Updates first.
Let the check and installation finish. If the organization manages updates and the controls are unavailable, contact the internal help desk.

For managed Microsoft 365 Apps fleets, Microsoft documents the Office Deployment Tool, Group Policy, Configuration Manager, and an internal update location as management options, with automatic updates from the Office CDN as the default. Microsoft 365 Apps updates are not distributed individually through Windows Update or WSUS, so WSUS-based patch reporting alone will not reflect this fix.

What the fix probably changes (inferred)

Microsoft has published no code-level detail. Fixes for this bug class typically do one or more of the following. Treat this as background on CWE 763, not a description of Microsoft's actual change:

ensure only the original allocation's base pointer is ever passed to the free routine
clarify object ownership so the parser and renderer do not both attempt to free the same object
clear the pointer after freeing so a later cleanup path cannot free it again

Office LTSC 2021 lifecycle note

Microsoft's lifecycle notice states that Office LTSC 2021 reached end of support on October 13, 2026, after which technical support, bug fixes, and security updates cease. Yet the Security Update Guide lists a fixed LTSC 2021 build for this CVE. The sources do not explain this or describe a support exception. LTSC 2021 installations should be brought to 16.0.14334.21048, and organizations should also follow Microsoft's stated migration path to Microsoft 365 Apps, or Office LTSC 2024 for those not ready to move to the cloud.

No CVE-specific workaround is documented. The only remediation is installing the fixed build.

Affected systems and versions

Per the NVD, CVE.org, and MSRC records:

Microsoft 365 Apps for Enterprise, 32 bit and x64 based systems: versions from 16.0.1 up to the per-channel November 10, 2026 builds listed above.
Microsoft Office LTSC 2021, 32 bit and x64 based systems: versions 16.0.1 up to but not including 16.0.14334.21048.
Microsoft Office LTSC 2024, 32 bit and x64 based systems: versions 16.0.0 up to but not including 16.0.17932.21140.

The vulnerable configuration is any of these installations in which Outlook opens or previews email. The Preview Pane is sufficient. The published product list does not establish that other Outlook editions or platforms are affected.

Vendor security history

The Cyber Safety Review Board's review of the summer 2023 Exchange Online intrusion is the most relevant independent assessment of Microsoft's security track record. The Board discussed a flaw in Microsoft's token validation logic, found the intrusion preventable, and concluded that Microsoft's security culture was inadequate and required an overhaul. It recommended direct executive and board oversight and a public security reform plan. That incident was a separate cloud identity case and is unrelated to CVE-2026-111309.

Microsoft responded that 16 of the Board's 25 recommendations apply to it and that it is acting on all 16. Its Secure Future Initiative is built on three principles: Secure by Design, Secure by Default, and Secure Operations. Microsoft states that part of senior leadership compensation depends on progress against security milestones. The July 2026 SFI progress report claims three objectives at target state, three nearing completion, and twelve showing significant progress. These are vendor-reported program outcomes. They say nothing about whether SFI prevented or detected this specific Outlook defect, and they do not substitute for confirming that endpoints run a fixed build.

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical information