Brief Summary: Microsoft Outlook CVE-2026-123376, a Heap-Based Buffer Overflow Leading to Remote Code Execution

Introduction

Outlook sits at the center of daily enterprise communication, so a code execution flaw reachable through a crafted file deserves a careful look even when no exploitation has been reported. Microsoft's November 10, 2026 Patch Tuesday release fixed CVE-2026-123376, a heap-based buffer overflow in Microsoft Office Outlook with a CVSS 3.1 base score of 8.8 that can lead to remote code execution once a user opens an attacker-supplied file.

The practical picture is fairly clear. Fixed builds exist for every listed product family, Microsoft reported no exploitation at release, and the Preview Pane is explicitly not an attack vector. This post summarizes what Microsoft and other sources have disclosed, what remains unknown, and how to confirm that a fleet is actually running a fixed build.

Technical information

Root cause

Microsoft classifies the bug as CWE-122, Heap Based Buffer Overflow. MITRE defines this weakness as writing past the end of a buffer that was allocated on the heap. The MSRC advisory describes the impact as allowing an unauthorized attacker to execute code over a network.

That is roughly where the public detail ends. Outlook is closed source, and there is no public commit, diff or patched function name to examine. Microsoft has not published a technical root cause, and the advisory does not identify:

• the affected function or parser
• the required file type or extension
• the delivery protocol
• the memory layout or corruption primitive
• any payload or exploitation reliability data

So we are not showing vulnerable code. Fixes for CWE-122 bugs generally add length or bounds checks before data from an untrusted file is copied into a heap buffer. That is an inference about this class of bug, not something Microsoft has confirmed for this CVE.

Attack flow

Based on Microsoft's FAQ, the disclosed exploitation sequence is narrow:

1. The attacker prepares a specially crafted file intended to trigger the heap overflow. The file format has not been disclosed.
2. The file reaches the target over a network, consistent with the AV:N metric. The specific delivery channel is not stated.
3. The user opens the file, a step that is mandatory (UI:R). Microsoft states the Preview Pane is not an attack vector, so displaying a message in the reading pane is not established as a trigger.
4. Processing the file causes a write past the end of a heap buffer, which the attacker uses to achieve code execution. No prior privileges or access to settings or files are needed (PR:N).

The network attack vector describes how the vulnerable code is reached, and the user interaction requirement describes what triggers it. The network classification does not mean that simply receiving an email is enough. The reviewed sources also do not establish an administrator execution context or a complete post-exploitation chain, so we are not claiming either.

Scoring

The published CVSS 3.1 base vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack vector: Network
• Attack complexity: Low
• Privileges required: None
• User interaction: Required
• Scope: Unchanged
• Confidentiality, Integrity, Availability: High

Microsoft also publishes a temporal score of 7.7:

E:U/RL:O/RC:C

Under the FIRST CVSS v3.1 specification, these metrics mean Unproven exploit code maturity, Official Fix, and Confirmed report confidence. The 8.8 base score is the right number for describing intrinsic severity, and the temporal score should not replace it. Microsoft's own severity rating is Important. That comes from a separate rating system, so it does not conflict with the CVSS score.

The NVD entry is marked Awaiting Enrichment. The 8.8 High score shown there comes from Microsoft, and NIST has not supplied its own assessment.

Exploitation status

At original publication, Microsoft recorded:

• Publicly disclosed: No
• Exploited: No
• Exploitability assessment: Exploitation Less Likely

OffSeq Threat Radar, in its November 10, 2026 observation, likewise reported no evidence of exploitation, no public exploit code indexed in Metasploit or Exploit DB, and no public nuclei template. It also reported that the CVE was not in CISA's Known Exploited Vulnerabilities catalog. No threat actors have been named for this CVE, and no EPSS probability was available in the reviewed sources. These are point-in-time assessments based on specific indexes and visibility, not proof that exploitation cannot or does not occur.

One source of confusion this month is CVE-2026-124194, an Outlook spoofing vulnerability with a 6.5 base score, which Cisco Talos and Qualys identify as the exploited Outlook issue in the November 2026 release. Qualys reports that CVE-2026-124194 was added to CISA KEV with a remediation date of November 24, 2026. That exploitation status and deadline belong to CVE-2026-124194, not to CVE-2026-123376. Here the higher-scoring flaw is not the exploited one, because severity and observed exploitation are separate prioritization inputs.

Patch information

Microsoft fixed CVE-2026-123376 in its November 10, 2026 Patch Tuesday release. The Security Update Guide sets the CVSS temporal Remediation Level to Official Fix (RL:O), meaning a complete vendor fix is available. MSRC's affected product API lists every affected SKU with productStatus: "fixed" and customerActionRequired: true, so systems only receive the fix by installing the update.

The fix ships as updated Office binaries. You confirm it by checking the build number, not by inspecting a code change. Microsoft's advisory does not list a CVE-specific workaround, and the Preview Pane exclusion is an attack condition rather than an alternative to patching.

Office LTSC fixed builds

• Microsoft Office LTSC 2024 (32-bit and 64-bit): fixed in 16.0.17932.21140 (Version 2408)
• Microsoft Office LTSC 2021 (32-bit and 64-bit): fixed in 16.0.14334.21048 (Version 2108)

Microsoft 365 Apps by servicing channel

Microsoft 365 Apps is serviced by channel, so there is no single fixed build. Microsoft points to its Office security release information, and the November 10, 2026 Office security release notes list this CVE. The minimum builds that carry the fix are:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office 2024 Retail and Office 2021 Retail: Version 2610 (Build 20527.20196)

The same release notes include a November build for Office 2019 Volume Licensed (Version 1808, Build 10417.20236), but MSRC's affected product list for this CVE does not include Office 2019.

Verifying the fix

Compare the installed Office build against the lists above:

• In any Office app, open File > Account > About, or read the VersionToReport value under the Click to Run configuration registry key.
• For LTSC 2021 the build must be at least 16.0.14334.21048. For LTSC 2024 it must be at least 16.0.17932.21140.
• For Microsoft 365 Apps, compare against the minimum build for the device's own channel and version. A Monthly Enterprise device on Version 2608, for example, needs Build 20326.20320 or later.

Microsoft's documentation adds a few operational details:

• Click to Run installs normally receive the fix through Office automatic updates, but managed fleets need to confirm that their update channel or deployment ring has moved to the November 2026 build.
• Office downloads updates in the background but applies them at an available opportunity, such as when Office apps close. Measure installation completion, not download.
• For individual machines, Microsoft Support documents File > Account (or Office Account in classic Outlook), then Update Options > Update Now, selecting Enable Updates first if needed. If Update Options is unavailable because updates are centrally managed, users are directed to Microsoft Update or their help desk.
• Cloud update supports a deadline that defaults to 3 days and is configurable from 0 to 14 days, with user postponements and a final countdown. This is a management capability rather than a CVE-specific schedule, and Microsoft notes the deadline feature does not apply to New Outlook or Teams.

Affected systems and versions

Per the CVE record and the MSRC advisory, the following products are affected in both 32-bit and 64-bit editions:

• Microsoft Office LTSC 2024: versions from 16.0.0 up to, but not including, 16.0.17932.21140
• Microsoft Office LTSC 2021: versions from 16.0.1 up to, but not including, 16.0.14334.21048
• Microsoft 365 Apps for Enterprise: the CNA lists a starting version of 16.0.1 and refers to Office security release information rather than a single numeric fixed boundary. Builds earlier than the November 2026 release for the device's servicing channel are affected.

Some feeds list the vendor as Unknown. The vendor is Microsoft, which is also the source of the NVD score. The advisory does not establish that every Outlook variant or every Microsoft email service is affected, and Office 2019 is not on MSRC's affected list for this CVE.

Vendor security history

Microsoft's products are deeply integrated into enterprise environments. Radicati's 2024 market report describes Microsoft as highly successful in cloud business email and collaboration and reports a worldwide Exchange mailbox split of 88% cloud and 12% on premises. Those are historical Exchange deployment figures, not an estimate of endpoints exposed to this CVE.

The most relevant recent item in Microsoft's track record is the Cyber Safety Review Board's review of the Summer 2023 Exchange Online intrusion. The Board reports that Storm-0558 compromised Exchange Online mailboxes belonging to 22 organizations and over 500 individuals in May and June 2023, using authentication tokens signed with a Microsoft key created in 2016. It describes a cascade of Microsoft security failures and a culture that deprioritized enterprise security investment and rigorous risk management. That incident involved cloud authentication and signing key trust, not an Outlook memory safety bug, and nothing links Storm-0558 to CVE-2026-123376.

Microsoft's July 2026 Secure Future Initiative progress report describes embedding security into governance, culture and engineering under the principles of Secure by Design, Secure by Default, Secure in Operations and Zero Trust, along with tighter source code access controls and reduced exposure from legacy settings. These are Microsoft-reported improvements. For this CVE, the actionable evidence is the availability of the fix itself.

References

• NVD: CVE-2026-123376
• CVE Record: CVE-2026-123376
• Microsoft Security Update Guide: CVE-2026-123376, Microsoft Office Outlook Remote Code Execution Vulnerability
• MSRC affected product API for CVE-2026-123376
• Microsoft Learn: Release notes for Microsoft Office security updates
• Microsoft Learn: Update history for Office LTSC 2024 and Office 2024
• Microsoft Learn: Keep Office apps up to date with the latest updates
• Microsoft Learn: Configure rollout waves and update deadline
• Microsoft Support: How to update Microsoft 365 or Office for Windows
• Cisco Talos: Microsoft Patch Tuesday for November 2026
• Qualys: Microsoft Patch Tuesday, November 2026 Security Update Review
• OffSeq Threat Radar: CVE-2026-123376
• MITRE CWE-122: Heap Based Buffer Overflow
• FIRST: CVSS v3.1 Specification Document
• Microsoft Learn: Microsoft 365 for enterprise overview
• Radicati: Microsoft 365, Exchange Server and Outlook Market Analysis, 2024 to 2028
• CSRB: Review of the Summer 2023 Microsoft Exchange Online Intrusion
• DHS: Cyber Safety Review Board Releases Report on Microsoft Online Exchange Incident from Summer 2023
• Microsoft Trust Center: SFI Progress Report July 2026