Brief Summary: Microsoft Outlook CVE-2026-119995 Heap-Based Buffer Overflow Enabling Remote Code Execution

Introduction

Outlook is where untrusted files from outside an organization meet a user who may open them, so a memory corruption flaw that turns a crafted Office file into remote code execution is worth understanding even when the exploitation conditions are demanding. In its November 10, 2026 Patch Tuesday release, Microsoft fixed exactly that kind of issue: CVE-2026-119995, a heap-based buffer overflow in Microsoft Office Outlook.

Microsoft scores the flaw 7.5 (High) under CVSS 3.1 and rates it Important under its own product severity scale. These are two separate rating systems, and both are worth preserving when communicating risk. At original publication Microsoft reported no known exploitation and assessed exploitation as less likely. The input data for this CVE listed the vendor as Unknown. The MSRC advisory and NVD record confirm Microsoft as the affected vendor and assigning CNA.

Technical Information

Classification and scoring

The advisory describes an unauthorized attacker executing code over a network through a heap-based buffer overflow in Outlook. Microsoft and NVD both map the issue to two weaknesses:

• CWE-122, Heap based Buffer Overflow: writing beyond the end of a buffer allocated on the heap. MITRE lists general consequences including crashes and, in some circumstances, overwriting function pointers to redirect execution.
• CWE-190, Integer Overflow or Wraparound: arithmetic that wraps around and can lead to memory corruption and buffer overflows, including cases where less memory is allocated than expected.

The CVSS 3.1 base vector is:

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Broken down:

• AV:N Network attack vector
• AC:H High attack complexity
• PR:N No privileges required
• UI:R User interaction required
• S:U Scope unchanged
• C:H / I:H / A:H High confidentiality, integrity, and availability impact

Microsoft's full vector appends E:U/RL:O/RC:C (Unproven exploit maturity, Official Fix, Confirmed report confidence), giving a temporal score of 6.5.

For prioritization, weigh the high potential impact against how conditional the exploitation is. The network attack vector does not override the explicit requirements for user interaction and substantial memory allocation.

Root cause

Outlook is closed source and Microsoft has not published the vulnerable function or the code change, so there is no public diff to review and no vulnerable snippet to show. What we can do is read the CWE pairing alongside the advisory FAQ.

Taken together, CWE-190 and CWE-122 describe a well-understood bug pattern. A size or length value read from attacker-controlled data goes into an arithmetic calculation, such as a count multiplied by an element size, or a header length added to a payload length. The result wraps around to a small number. The application allocates a heap buffer of that small size, then copies or writes the real, much larger amount of data into it, overrunning the buffer.

The FAQ fits this pattern. It states that exploitation requires the application to "allocate a large amount of memory while processing a specially crafted document." Inputs large enough to make a size calculation wrap are exactly what this class of bug needs. Fixes for this class typically add overflow-checked arithmetic, or reject sizes beyond a sane limit, before allocation, and keep subsequent writes within the size actually allocated.

This reconstruction is an inference from the CWE pairing and the FAQ wording. The advisory does not disclose the arithmetic operation or confirm the sequence connecting the two weaknesses, so a specific chain from integer overflow to undersized allocation to code execution remains not publicly confirmed for this CVE.

Attack flow

Microsoft documents the following prerequisites:

1. The attacker sends the target user a malicious Office file.
2. The attacker convinces the user to open it.
3. While processing the specially crafted document, the affected application must be able to allocate a large amount of memory.
4. Successful exploitation can result in remote code execution.

Two scoping notes apply:

• The Preview Pane is not an attack vector. Microsoft states this explicitly. Assumptions carried over from other Outlook bugs where previewing a message is sufficient do not apply to this CVE.
• Receiving a message is not enough. The user has to open the malicious file, so this should not be described as automatic or zero-click exploitation.

What remains undisclosed

The advisory does not specify the file extension or document structure involved, the memory quantity required, the vulnerable function, a working exploitation procedure, or the security context code would run in after successful exploitation. The available information supports exposure assessment and patching, but not exploit reproduction or signatures based on internal program behavior.

Exploitation status

Microsoft's exploitability assessment, tied to the time of original publication:

• Publicly disclosed before release: No
• Exploited at release: No
• Exploitation assessment: Exploitation Less Likely
• Exploit code maturity: Unproven (exploit code unavailable or theoretical)
• Named threat actor or campaign: none identified in the reviewed material

The finder is credited as Anonymous through Microsoft's coordinated vulnerability disclosure acknowledgement. That is a reporting credit, not an attacker identification. NVD lists the record as Awaiting Enrichment, and the 7.5 score shown there is attributed to Microsoft as CNA rather than an independent NVD assessment.

The same Patch Tuesday also fixed CVE-2026-124194, a separate Outlook spoofing vulnerability that is easy to confuse with this one. Reporting describes it as actively exploited to steal NTLM account hashes using a specially crafted message file and an attacker-controlled network location. That activity does not establish exploitation of CVE-2026-119995, which appears separately in the same reporting as an Important-rated Outlook remote code execution issue.

Patch Information

Microsoft fixed CVE-2026-119995 in its November 10, 2026 Patch Tuesday release, and the advisory sets the CVSS Remediation Level to Official Fix (RL:O). Because Outlook is closed source, the fix is delivered only as updated Office builds. There is no public commit to inspect.

Fixed builds (MSRC Security Update Guide)

• Microsoft Office LTSC 2024 (32-bit and 64-bit): 16.0.17932.21140
• Microsoft Office LTSC 2021 (32-bit and 64-bit): 16.0.14334.21048
• Microsoft 365 Apps for Enterprise (32-bit and 64-bit): per-channel builds listed at aka.ms/OfficeSecurityReleases

Microsoft 365 Apps channel builds

Microsoft's Office security release notes for November 10, 2026 list CVE-2026-119995 under the Outlook section with these builds:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel (receives Monthly Enterprise Channel builds): Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office LTSC 2024 Volume Licensed: Version 2408 (Build 17932.21140)
• Office LTSC 2021 Volume Licensed: Version 2108 (Build 14334.21048)

The same release lists Office 2024 Retail and Office 2021 Retail at Version 2610 (Build 20527.20196). It also lists Office 2019 Volume Licensed at Build 10417.20236, but the MSRC affected products table for this CVE does not include Office 2019, so that build should not be treated as a fix for this CVE.

An LTSC build number is not a universal target for Microsoft 365 Apps. Check subscription installs against the build for their specific update channel.

Verifying patch status

Compare the installed Office build against the builds above. The previous monthly release (October 13, 2026) shipped LTSC 2024 Build 17932.21056 and LTSC 2021 Build 14334.20974, and any machine at or below those builds lacks the fix. Click to Run installs of Microsoft 365 Apps update automatically by channel, so the Outlook fix arrives in the regular monthly cumulative build rather than as a standalone hotfix. The same release also fixes other Outlook CVEs, including CVE-2026-119993, CVE-2026-119996, and CVE-2026-119997, so reaching the fixed build covers them together.

Applying the update

Microsoft Support documents this procedure for Microsoft 365 or Office for Windows:

1. Open a Microsoft 365 application, such as Word, and create a new document.
2. Select File, then Account. In Classic Outlook, the option is Office Account.
3. Under Product Information, select Update Options, then Update Now.
4. If necessary, select Enable Updates first.
5. Allow Office to finish checking for and installing updates.

If Update Options is missing and only About appears, the installation may be managed through volume licensing or Group Policy. Microsoft's documented alternatives are to try Microsoft Update or contact the organization's help desk.

Microsoft has not published a separate mitigation or workaround for this CVE. There is no sourced basis for substituting a registry change, disabling a particular Outlook feature, or blocking a specific file extension in place of the update. The Preview Pane exclusion describes attack scope, not a configuration recommendation.

Affected Systems and Versions

Per the MSRC advisory, with version boundaries corroborated by NVD and the CVE record (Windows, 32-bit and x64):

• Microsoft 365 Apps for Enterprise: affected from 16.0.1. The upper boundary points to Microsoft's Office security releases resource rather than a single fixed build, so remediate with the build for the installed update channel listed above.
• Microsoft Office LTSC 2021: affected from 16.0.1 up to but not including 16.0.14334.21048.
• Microsoft Office LTSC 2024: affected from 16.0.0 up to but not including 16.0.17932.21140.

Exploitation requires the user to open a malicious Office file and the application to be able to allocate a large amount of memory while processing it. The Preview Pane is not an attack vector.

Vendor Security History

Microsoft is the affected vendor and the assigning CNA. Its annual report describes Microsoft 365 Commercial as an integrated productivity platform combining Office, Windows, Microsoft 365 Copilot, and Enterprise Mobility + Security, with a broader portfolio including Exchange, SharePoint, and Teams.

The most relevant independent assessment of Microsoft's security track record is the Cyber Safety Review Board's review of the 2023 Exchange Online intrusion attributed to Storm-0558, an actor associated with the government of the People's Republic of China, which accessed email accounts of senior United States government officials. The Board concluded the intrusion was preventable, identified avoidable errors and detection shortcomings, and found that Microsoft's security culture required an overhaul. It recommended direct attention from Microsoft's CEO and board, a public reform plan, and leadership accountability.

In June 2024, Microsoft accepted responsibility for the issues the Board identified and described its Secure Future Initiative, launched in November 2023 as a multiyear change to product design, development, testing, and operations organized around Secure by Design, Secure by Default, and Secure Operations. Microsoft also described leadership compensation changes tied to cybersecurity performance.

This history is useful context for evaluating vendor accountability. It does not indicate that Storm-0558 exploited CVE-2026-119995 or that the incidents share a technical cause. For this CVE, the controlling evidence is the affected product list, the exploitation prerequisites, and the available updates.

References

• MSRC Security Update Guide: CVE-2026-119995
• NVD: CVE-2026-119995
• CVE Record: CVE-2026-119995
• Release notes for Microsoft Office security updates
• Update history for Microsoft 365 Apps (listed by date)
• How to update Microsoft 365 or Office for Windows
• BleepingComputer: Microsoft November 2026 Patch Tuesday coverage
• CISA Known Exploited Vulnerabilities Catalog
• Threat Radar entry for CVE-2026-119995
• MITRE CWE-122: Heap based Buffer Overflow
• MITRE CWE-190: Integer Overflow or Wraparound
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft On the Issues: Microsoft's work to strengthen cybersecurity protection
• Microsoft 2026 Annual Report