Quick Look: Microsoft Outlook CVE-2026-123375, a Stack-Based Buffer Overflow Leading to Remote Code Execution

Introduction

According to Microsoft, a specially crafted attachment that a user is persuaded to preview in Outlook is enough for an attacker to run code with that user's privileges. Outlook sits on a very large share of enterprise desktops and processes untrusted content from outside senders every day. A memory corruption bug in its attachment handling is worth understanding precisely, even when exploitation has not been observed.

CVE-2026-123375 was published on November 10, 2026 as part of Microsoft's November Patch Tuesday release. The source data listed the vendor as Unknown, but Microsoft is both the affected vendor and the CVE assigning authority. The flaw carries a CVSS 3.1 base score of 8.8 (High), while Microsoft's own product severity rating is Important. These are two different classification systems, not conflicting scores. In this post we summarize what Microsoft has published, what the weakness classification implies, and which builds contain the fix.

Technical Information

Severity and attack conditions

Microsoft supplies the following base vector, which NVD currently attributes to Microsoft while the NVD record awaits enrichment:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Broken down:

• Attack Vector: Network. The attack can originate remotely, in this case via a delivered attachment.
• Attack Complexity: Low.
• Privileges Required: None. The attacker needs no prior access.
• User Interaction: Required. A user has to take an action, so this is not an interaction-free attack.
• Scope: Unchanged.
• Confidentiality, Integrity, Availability: High.

Microsoft also publishes a temporal score of 7.7, with the extended vector ending in:

E:U/RL:O/RC:C

That translates to Exploit Code Maturity: Unproven, Remediation Level: Official Fix, and Report Confidence: Confirmed.

Root cause: an integer underflow feeding a stack overflow

Microsoft maps this bug to two weaknesses:

• CWE 191: Integer Underflow (Wrap or Wraparound), where a subtraction produces a result below the minimum allowable integer value.
• CWE 121: Stack based Buffer Overflow, where data is written past the end of a buffer allocated on the stack.

This pairing describes a well-understood memory corruption chain. A length or size value is computed by subtracting one number from another, for example a declared field size minus a header size. If the attacker controls the input so that the subtracted value is larger, an unsigned result wraps around to a very large number. That number is then used as the length for a copy into a fixed-size stack buffer, so the copy runs past the buffer and overwrites adjacent stack data. MITRE notes that this class of weakness can corrupt execution-relevant data and lead to crashes or arbitrary code execution.

Outlook is closed source, and Microsoft has not published the vulnerable function, the attachment format involved, the triggering field, or the code change. The chain above is our inference from the CWE pairing, not a confirmed description of Microsoft's code. The public records do not state whether the underflow produces an incorrect copy length, an incorrect allocation, or some other value that leads to the overflow.

The preview nuance

Microsoft's FAQ answers No to the question of whether the Preview Pane is an attack vector, yet the following answer describes an attacker convincing a user to preview an attachment in Outlook. The advisory does not explain the technical distinction between the excluded Preview Pane and the described attachment preview workflow.

Two practical consequences follow. First, neither "receiving the email is enough" nor "previewing any message is enough" is supported by the advisory. Second, disabling the Preview Pane is not an established mitigation for this CVE.

Attack flow

Based on Microsoft's published description, the documented scenario looks like this:

1. The attacker prepares a specially crafted attachment designed to trigger the flaw.
2. The attacker delivers it to a target, for example by email.
3. The attacker convinces the user to preview the attachment in Outlook.
4. While Outlook processes the attachment, the malformed input triggers the underflow and the resulting stack overflow (mechanism inferred from the CWE classification).
5. On successful exploitation, attacker code runs with the privileges of the user. The advisory does not establish automatic administrator or SYSTEM-level execution.

Exploitation status at publication

Microsoft's exploitability assessment, which reflects status at original publication:

• Publicly disclosed: No
• Exploited: No
• Assessment: Exploitation Less Likely
• Exploit Code Maturity: Unproven (E:U)

One upstream summary described this patch as fixing a zero day. MSRC's data does not support that. The exploited Outlook vulnerability in November 2026 coverage is CVE-2026-124194, a separate spoofing issue associated with NTLMv2 hash disclosure, and its exploitation status should not be carried over to CVE-2026-123375. No threat actor, campaign, or indicator of compromise has been publicly tied to this CVE.

Patch Information

Microsoft fixed CVE-2026-123375 in its November 10, 2026 Patch Tuesday release. Because Outlook is closed source, there is no public commit, diff, or code snippet to review. The fix ships only as updated Office binaries. The CVE record tags the MSRC advisory as both vendor-advisory and patch, and the temporal vector's RL:O confirms an official vendor fix.

Given the CWE pairing, the corrected code most likely validates that the subtraction cannot go below zero before it occurs, and/or checks the computed length against the destination buffer size before copying. Again, this is an inference from the weakness classification, not a confirmed description of the change.

First fixed builds (32 bit and 64 bit), released November 10, 2026:

• Microsoft Office LTSC 2021: 16.0.14334.21048 (Version 2108)
• Microsoft Office LTSC 2024: 16.0.17932.21140 (Version 2408)

Microsoft 365 Apps for Enterprise has no single fixed build number. The Office security release notes list CVE-2026-123375 under Outlook in the November 10, 2026 release, with the fix included in:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)

For comparison, the October 13, 2026 builds (LTSC 2024 Build 17932.21056, LTSC 2021 Build 14334.20974) predate the fix and remain vulnerable. The fix is not a standalone hotfix. It is bundled into the monthly cumulative Office update alongside the other November Outlook fixes, CVE-2026-123376 through CVE-2026-123385. Any installation on a November 2026 build or later is covered.

Applying the update. Microsoft's documented procedure for Office on Windows:

1. Open a Microsoft 365 application, such as Word, and create a new document.
2. Select File > Account, or Office Account in Classic Outlook.
3. Under Product Information, select Update Options > Update Now.
4. If necessary, select Enable Updates first, then Update Now.
5. Close the confirmation window once updates are installed.

If the Update Options control is missing, the installation may be volume licensed or managed through Group Policy. That does not mean the device is protected. Administrators can manage Office update settings through the Office Deployment Tool or Group Policy, and Microsoft recommends trying Microsoft Update or contacting the help desk in that situation.

Microsoft does not publish a CVE-specific workaround. Preview Pane changes, macro policy changes, attachment filtering rules, and registry edits are not established fixes for this flaw.

Credit: Microsoft credits Kentaro Kawane (GMO Cybersecurity by Ierae, Inc.), Minjea Park, and Jmini for the coordinated disclosure.

Affected Systems and Versions

The CVE record lists the following products, each in both 32-bit and x64 editions:

• Microsoft Office LTSC 2021: versions from 16.0.1 up to, but not including, 16.0.14334.21048
• Microsoft Office LTSC 2024: versions from 16.0.0 up to, but not including, 16.0.17932.21140
• Microsoft 365 Apps for Enterprise: versions from 16.0.1 up to the current security release, with the fixed boundary depending on the update channel (see the channel builds above)

These are product-specific boundaries, not a universal Office version requirement, and LTSC build numbers should not be applied to Microsoft 365 Apps. The record does not list Outlook.com or other Microsoft communication services as affected.

Vendor Security History

Microsoft's footprint makes reliable patching especially consequential. The Cyber Safety Review Board, in its review of the summer 2023 Exchange Online intrusion, described Microsoft's products as ubiquitous and found that Microsoft did not detect the compromise of its own cryptographic assets, relying instead on a customer to spot anomalies. The Board concluded that a series of operational and strategic decisions reflected a culture that deprioritized enterprise security investment and rigorous risk management, and recommended a public security reform plan overseen by Microsoft's CEO and Board.

Microsoft's response, the Secure Future Initiative, is built on Secure by Design, Secure by Default, and Secure Operations, and ties part of senior leadership compensation to security progress. Its July 2026 progress report cites stronger cryptographic safeguards, reduced legacy authentication exposure, secure tenant creation with drift detection, and broadly enforced Zero Trust for source code access. None of this history is connected to the mechanism of CVE-2026-123375. It is context for evaluating vendor assurance, separate from the immediate patch decision.

References

• NVD entry for CVE-2026-123375
• CVE.org record for CVE-2026-123375
• Microsoft Security Update Guide: CVE-2026-123375
• CVE List V5 JSON record
• Microsoft Learn: Microsoft 365 Apps security updates
• Microsoft Learn: Release notes for Office security updates
• Microsoft Support: How to update Microsoft 365 or Office for Windows
• Microsoft Learn: Keep Office apps up to date
• MITRE CWE 121: Stack based Buffer Overflow
• MITRE CWE 191: Integer Underflow (Wrap or Wraparound)
• Zero Day Initiative: The November 2026 Security Update Review
• Tenable: November 2026 Microsoft Patch Tuesday
• SecurityWeek: Exploited Outlook Zero Day Among 1,094 Flaws Patched by Microsoft
• CSRB: Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft Blog: Prioritizing security above all else
• Microsoft Trust Center: SFI Progress Report July 2026
• Microsoft Form 10K (fiscal year ending June 30, 2026)