Brief Summary: Microsoft Outlook CVE-2026-123377 Heap-Based Buffer Overflow Enabling Code Execution via Crafted Contact Certificates

Introduction

Microsoft's November 10, 2026 Patch Tuesday release fixed a heap-based buffer overflow in Outlook that can give an unauthenticated remote attacker code execution in the context of a user who opens a crafted contact file and views its certificates. With a CVSS 3.1 base score of 8.8, no attacker privileges required, and every Microsoft 365 Apps for Enterprise and Office LTSC client in scope, CVE-2026-123377 belongs on the patch list even though Microsoft reports no exploitation at publication.

The original CVE data listed the vendor as Unknown. Microsoft is both the affected vendor and the assigning CNA, so the MSRC advisory and the Office security release notes are the authoritative sources for this issue.

Technical information

Root cause

Microsoft and NVD map this vulnerability to two weaknesses:

• CWE-122, Heap based Buffer Overflow: writing beyond the end of a buffer allocated on the heap. MITRE notes that such corruption can affect availability and, in some circumstances, redirect execution.
• CWE-190, Integer Overflow or Wraparound: MITRE explains that integer overflow can lead to allocating less memory than expected, which can then contribute to a buffer overflow.

Taken together, the pairing usually describes a well-understood bug pattern:

1. A length or count read from the file is used in a size calculation that wraps around.
2. The wrapped value causes a heap buffer to be allocated too small.
3. A later copy writes past the end of that buffer.

Microsoft has not disclosed the vulnerable function, the exact arithmetic operation, the contact file extension, the malformed field, the memory layout, or any payload construction. The three steps above are the generic shape implied by the CWE pairing. They are not a confirmed reconstruction of this specific Outlook flaw. Outlook is closed source, there is no public diff, and we have not reproduced any vulnerable code.

What the advisory does identify is the code path that parses and displays certificate data attached to a contact item.

Attack flow

Microsoft documents the following exploitation scenario:

1. The attacker sends the target a specially crafted contact file.
2. The attacker persuades the recipient to open the contact file in Outlook.
3. The attacker persuades the recipient to view that contact's certificates.
4. Processing the malicious certificate data corrupts heap memory, which could allow code execution with the recipient's privileges.

The defining feature is the second user action. Microsoft does not describe opening the contact as sufficient on its own, and the certificate view is part of the documented chain. Microsoft also states explicitly that the Preview Pane is not an attack vector. Simply receiving or rendering an email does not trigger the bug, and Microsoft does not describe it as a privilege escalation or an automatic system-level compromise.

CVSS assessment

Microsoft supplies the following CVSS 3.1 vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector: Network. The attack can originate remotely.
• Attack Complexity: Low. No specialized access conditions are required.
• Privileges Required: None. No prior authorization is needed.
• User Interaction: Required. The recipient must open the contact and view its certificates.
• Scope: Unchanged. Impact does not cross a security authority boundary.
• Confidentiality, Integrity, Availability: High. Substantial impact in all three areas if exploitation succeeds.

The base score is 8.8. The temporal score is 7.7, reflecting Unproven exploit maturity and the availability of an Official Fix. Microsoft's product severity rating is Important, while NVD labels the numeric score High. These are different classification systems, not conflicting assessments.

Exploitation status

At publication, Microsoft records the following for CVE-2026-123377:

• Publicly disclosed: No
• Exploited: No
• Exploitability assessment: Exploitation Less Likely
• Exploit maturity: Unproven
• Credited researcher: Kentaro Kawane with GMO Cybersecurity by Ierae, Inc.

OffSeq Threat Radar reports no indexed public exploit in Metasploit or Exploit DB, no public Nuclei template, and no evidence of exploitation in the wild on its record. That is limited to its own coverage and does not prove that private exploit development is absent.

One upstream summary described this as a critical fix that had been observed in the wild. Both claims are incorrect: Microsoft's advisory and the SANS ISC table list it as Important and Exploited: No.

This CVE should also be kept separate from November's actual Outlook zero day, CVE-2026-124194. That is an Outlook spoofing vulnerability exploited to steal NTLM hashes via a crafted message file that makes Outlook connect to an attacker-controlled location. CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on November 10. CVE-2026-123377 was not among those six additions. Evidence about one does not transfer to the other.

Patch information

Microsoft fixed CVE-2026-123377 in its November 10, 2026 Patch Tuesday release. The MSRC advisory sets the CVSS temporal Remediation Level to Official Fix, meaning a complete vendor fix is available.

What the fix changes

Because Outlook ships only as compiled binaries, there is no public commit or code snippet for this CVE. Based on the CWE pairing, the correction probably adds checked or overflow-safe arithmetic, or a bounds check, before the certificate buffer is allocated and filled. Microsoft has not published this, so treat it as an inference. Patch diffing the old and new Outlook binaries is the only way to confirm the exact change.

Fixed builds

MSRC lists these fixed builds, released November 10, 2026:

• Microsoft Office LTSC 2024 (32-bit and 64-bit): 16.0.17932.21140
• Microsoft Office LTSC 2021 (32-bit and 64-bit): 16.0.14334.21048
• Microsoft 365 Apps for Enterprise (32-bit and 64-bit): channel-specific builds, with MSRC pointing to the Office security release notes

The Office security release notes list CVE-2026-123377 under the November 10, 2026 release with these builds per channel:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel (receives Monthly Enterprise Channel builds): Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
• Office LTSC 2024 Volume Licensed: Version 2408 (Build 17932.21140)
• Office LTSC 2021 Volume Licensed: Version 2108 (Build 14334.21048)

The LTSC builds on the release notes page match the MSRC advisory. Do not borrow an LTSC build number to judge a Microsoft 365 Apps client. Use the build for that client's channel.

How the fix is delivered

Office uses Click to Run, so the patch arrives as a normal servicing build through each update channel rather than as a separate KB installer. Microsoft Support documents the manual workflow:

1. Open an Office application, such as Word, and create a document.
2. Select File > Account (in Classic Outlook this may appear as Office Account).
3. Under Product Information, select Update Options > Update Now.
4. If necessary, select Enable Updates first.
5. Allow Office to check for and install updates.

If Update Options is missing and only an About button appears, the installation is likely volume licensed or updates are controlled through Group Policy, and the organization's update mechanism applies.

Office LTSC 2021 normally receives updates from the Office CDN via the Office Automatic Updates 2.0 scheduled task and prompts users to close Office apps to finish installation. Microsoft states that Microsoft Update or WSUS alone cannot update Office LTSC 2021, while Configuration Manager can manage and deploy its updates. An operating system patch deployment does not, by itself, cover these clients.

Verifying the fix

Check the installed build under File > Office Account > About and compare it with the list above. A build at or above the listed number for the client's channel or LTSC edition contains the fix.

No vulnerability-specific configuration workaround has been published. Disabling the Preview Pane is not a remedy, since Microsoft states it is not an attack vector.

Related fixes in the same builds

The same release fixed a cluster of adjacent Outlook RCE vulnerabilities, including CVE-2026-123375, CVE-2026-123376, CVE-2026-123378 through CVE-2026-123384, and CVE-2026-124228. All of them ship in the same builds, so applying the November update addresses the whole group.

Affected systems and versions

The CVE record and NVD identify the following affected products, each covering both 32-bit and x64-based systems:

• Microsoft 365 Apps for Enterprise: affected versions beginning at 16.0.1, fixed in the channel-specific November 10, 2026 builds listed above.
• Microsoft Office LTSC 2021: affected from 16.0.1 up to, but not including, 16.0.14334.21048.
• Microsoft Office LTSC 2024: affected from 16.0.0 up to, but not including, 16.0.17932.21140.

The vulnerable configuration is any of these Outlook clients below the fixed build where a user can be persuaded to open a crafted contact file and view its certificates. The published scope does not extend to every Microsoft email product.

Vendor security history

Microsoft's most prominent recent security failure involving its email platform is the summer 2023 Exchange Online intrusion. The Cyber Safety Review Board attributed it to the actor tracked as Storm 0558, associated with the government of the People's Republic of China. A Microsoft consumer signing key allowed the actor to forge authentication tokens, and a token validation flaw extended that access to enterprise Exchange Online accounts. The Board concluded the intrusion was preventable, citing a cascade of avoidable errors, an inadequate security culture, and failures in detection and public communication. That incident involved a different system and mechanism, and nothing ties it to CVE-2026-123377.

Microsoft's response was the Secure Future Initiative, launched in November 2023 around Secure by Design, Secure by Default and Secure Operations. Its July 2026 progress report describes stronger source code access controls, centrally governed build pipelines and a shift toward behavior- and baseline-driven detection. These are Microsoft-reported improvements and are not evidence about this particular Outlook bug.

For broader context, the UK Competition and Markets Authority announced on May 14, 2026, an investigation into Microsoft's business software ecosystem, covering bundling, interoperability and defaults. It is an investigation, not a finding of wrongdoing.

References

• MSRC Security Update Guide: CVE-2026-123377
• NVD entry for CVE-2026-123377
• CVE Record: CVE-2026-123377
• Microsoft 365 Apps security updates release notes
• Release notes for Microsoft Office security updates
• Update history for Office LTSC 2024 and Office 2024
• Update Office LTSC 2021
• How to update Microsoft 365 or Office for Windows
• Rapid7: Patch Tuesday November 2026
• SANS ISC: Microsoft Patch Tuesday diary
• Zero Day Initiative: The November 2026 Security Update Review
• BleepingComputer: Microsoft November 2026 Patch Tuesday and Outlook zero day
• CISA: Six Known Exploited Vulnerabilities added to catalog
• OffSeq Threat Radar entry for CVE-2026-123377
• MITRE CWE-122: Heap based Buffer Overflow
• MITRE CWE-190: Integer Overflow or Wraparound
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft Secure Future Initiative
• SFI Progress Report July 2026
• Microsoft Office is part of Microsoft 365
• CMA investigation into Microsoft's business software ecosystem