Brief Summary: Microsoft Outlook CVE-2026-123380 Heap-Based Buffer Overflow Enabling Remote Code Execution

Introduction

Microsoft's November 2026 Patch Tuesday fixed a heap-based buffer overflow in Outlook that can let a remote attacker with no prior access run code with the targeted user's privileges. The attack starts with a crafted email and depends on a routine action, copying an attachment, which enterprise users do constantly.

CVE-2026-123380 carries a CVSS 3.1 base score of 8.8, yet it requires user interaction, Microsoft explicitly rules out the Preview Pane as an attack vector, and no exploitation had been reported at publication. This post summarizes what Microsoft and the public records say, and where the disclosure stops.

Technical Information

Root cause

Microsoft classifies the flaw as CWE-122, Heap based Buffer Overflow. MITRE defines this weakness as writing beyond the end of a buffer allocated on the heap. For the weakness class in general, consequences can include application crashes, memory modification, protection bypass, and arbitrary code execution. For this specific CVE, the impact Microsoft confirms is remote code execution.

Office is closed source, so there is no public commit, diff, or vulnerable code snippet to examine. Microsoft has not named the vulnerable function, the parser involved, the attachment format, or the heap layout that gets corrupted. The advisory FAQ ties the overflow to an attachment that is copied in Outlook and then processed by another application. That suggests the defect lives in how Outlook builds or serializes attachment data when it hands that data off during a copy operation. Microsoft has not said this. It is our inference from the documented trigger.

Documented attack flow

Microsoft's advisory describes the following scenario:

1. The attacker sends a specially crafted email to the target.
2. The attacker persuades the recipient to copy an attachment in Outlook.
3. Another application processes the copied attachment, and the heap overflow occurs during that processing.
4. Successful exploitation results in code execution with the recipient's privileges.

The scenario has some clear limits:

• Preview Pane is not an attack vector. Microsoft says so directly, so Preview Pane exploitation narratives from other Office bugs do not apply here.
• Receipt alone is not documented as sufficient. The advisory does not establish that merely receiving or opening the email triggers the overflow. The copy action is part of the described chain.
• The second application is unidentified. The advisory does not say which application processes the copied attachment, or whether a particular clipboard format or file parser is involved.
• No privilege elevation is described. Code runs in the user's context, and Microsoft does not mention escalation to administrator.

This scenario comes from Microsoft's advisory rather than from a published account of a real attack.

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector: Network, Attack Complexity: Low. The attack can be delivered remotely by email.
• Privileges Required: None. The attacker needs no existing access.
• User Interaction: Required. The recipient has to copy the attachment.
• Scope: Unchanged.
• Confidentiality, Integrity, Availability: High. Successful exploitation affects all three.

Microsoft's temporal score is 7.7, reflecting exploit maturity Unproven (E:U), remediation level Official Fix (RL:O), and report confidence Confirmed (RC:C). Microsoft's own maximum severity rating is Important, while the CVSS base score maps to High. The two come from separate rating systems and do not contradict each other. NVD lists the record as Awaiting Enrichment and displays Microsoft's score. NIST has not published its own assessment.

Exploitation status

At original publication, Microsoft recorded:

• Exploited: No
• Publicly disclosed: No
• Exploitability assessment: Exploitation Less Likely
• Exploit code maturity: Unproven

OffSeq's CVE profile separately reports no evidence of exploitation in the wild, no CISA Known Exploited Vulnerabilities listing, and no recorded attack traffic in its Mirage sensors, with a data point of November 10, 2026, 18:35 UTC. It also reports no indexed Nuclei template and no public exploit code in Metasploit or Exploit DB. These findings cover specific datasets at a specific time. They do not prove that private exploits or unobserved activity are absent. No named threat actor, campaign, or indicator of compromise has been disclosed for this CVE.

Not the Outlook zero day from the same day

The November 10, 2026 coverage of an actively exploited Outlook zero day refers to a different identifier. CISA added CVE-2026-124194, an Outlook issue involving missing user interaction for a potentially unsafe action, to its KEV catalog based on active exploitation. BleepingComputer describes that bug as capable of exposing NTLM account hashes when a user opens a crafted message file and Outlook connects to an attacker-controlled location without the usual warning. CVE-2026-123380 is not in the CISA list, and a shared product name is no reason to carry exploitation status, credential theft behavior, or attribution from one bug to the other.

Patch Information

Microsoft fixed CVE-2026-123380 on November 10, 2026 as part of that month's Patch Tuesday. Because Office is closed source, the fix ships as updated Office binaries, and everything known about it comes from Microsoft's advisory, the CVE and CSAF records, and the Office security release notes.

What the vendor records say

• The published CVSS vector sets remediation level to Official Fix (RL:O), with exploit maturity Unproven (E:U) and report confidence Confirmed (RC:C). The temporal score drops to 7.7 because a complete vendor fix exists.
• The CVE record tags the MSRC advisory as both vendor-advisory and patch. Microsoft's CSAF VEX document lists 6 known affected and 6 fixed products, meaning every affected SKU has a matching fixed build.
• Microsoft has not named the function or described the code change. Bugs in this class are usually fixed by checking lengths before writing into a heap buffer, or by sizing the buffer from validated input. That is a general inference about the bug class, not a vendor statement.

Fixed builds by product (32-bit and 64-bit)

• Microsoft Office LTSC 2024: vulnerable from 16.0.0 to below 16.0.17932.21140. First fixed build: 16.0.17932.21140 (Version 2408).
• Microsoft Office LTSC 2021: vulnerable from 16.0.1 to below 16.0.14334.21048. First fixed build: 16.0.14334.21048 (Version 2108).
• Microsoft 365 Apps for Enterprise: vulnerable from 16.0.1 to below the November 2026 channel build. The fix depends on the channel, and Microsoft points to aka.ms/OfficeSecurityReleases.

Microsoft 365 Apps channel builds

Microsoft 365 Apps has no single fixed version number. The November 10, 2026 Office security release notes, which list this CVE, give these builds:

• Current Channel: Version 2610, Build 20527.20196
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), and Version 2608 (Build 20326.20320)
• Semi Annual Enterprise Channel: see the release notes for each supported version's build

These are channel-specific identifiers, not interchangeable targets. Use the entry that matches your deployment. The same release notes list Retail Office 2021/2024 at Version 2610, Build 20527.20196, although the MSRC advisory names only the three product families above as affected.

Delivery and verification

These are Click to Run builds, so the fix arrives as a full Office build update rather than a standalone KB file patching a single DLL. A device whose build number is at or above the fixed build for its channel has the patched Outlook code. The November release notes also include fixes for sibling Outlook RCEs disclosed the same day (CVE-2026-123375 through CVE-2026-123384), so moving to the November build addresses the whole group.

To verify a client, check the build under File > Account > About Outlook (Microsoft's LTSC documentation also describes inspecting the version under File > Account, in the Product Information area) and compare it with the builds above. To request an update manually, Microsoft documents File > Account > Update Options > Update Now. Organizations can also deliver updates through the Office Content Delivery Network, an internal shared folder, or Microsoft Configuration Manager. The official Office LTSC 2024 update history lists Build 17932.21140 as released November 10, 2026.

No CVE-specific workaround is published, and Preview Pane changes are not a substitute for the update.

What we do not know

Microsoft has not published technical details beyond the CWE classification and the copy attachment trigger. There is no information on which parsing routine was hardened or whether the change covers other attachment handling paths. Unless researchers publish binary diffing of the old and new Outlook builds, the version-to-build mapping above is the only reliable public evidence for the fix.

Affected Systems and Versions

The CVE record lists the following products, on both 32-bit and x64 systems:

• Microsoft Office LTSC 2024: versions 16.0.0 up to, but not including, 16.0.17932.21140
• Microsoft Office LTSC 2021: versions 16.0.1 up to, but not including, 16.0.14334.21048
• Microsoft 365 Apps for Enterprise: versions from 16.0.1 up to the November 2026 security build for the deployed channel

Some scoping notes:

• Office for Mac is not listed for this CVE. Do not substitute Mac version thresholds from other Office advisories.
• Exchange Online and Exchange Server are not listed. Hosting mail in the cloud does not replace the Office client update.
• Office LTSC 2021 lifecycle discrepancy: Microsoft's lifecycle announcement states that Office LTSC 2021 reached end of support on October 13, 2026, after which security updates cease. The November release material and this CVE record nonetheless list an LTSC 2021 fixed build, and the reviewed sources neither explain this nor announce a support extension. The listed fix should not be read as continuing support. Microsoft's stated migration paths are Microsoft 365 Apps, or Office LTSC 2024 for organizations not ready to move to the cloud.

Vendor Security History

Microsoft is both the affected vendor and the CVE Numbering Authority for this record. Outlook is part of the Microsoft 365 ecosystem alongside Exchange, SharePoint, Teams, and OneDrive. Radicati reported that in 2023, 88% of worldwide Exchange mailboxes were in cloud deployments and 12% on premises. Those figures describe Exchange deployment, not Outlook's installed base, but they give a sense of the platform's reach.

The most significant independent assessment of Microsoft's recent security record is the Cyber Safety Review Board's review of the Summer 2023 Exchange Online intrusion. DHS reported that the Board found the intrusion by Storm-0558, assessed as affiliated with the People's Republic of China, was preventable, and identified operational and strategic decisions that collectively deprioritized enterprise security investment and rigorous risk management. The Board recommended a public plan for fundamental security reforms, and DHS noted that Microsoft fully cooperated. This is historical context. It is not evidence of any link between Storm-0558 and CVE-2026-123380.

Microsoft's July 2026 Secure Future Initiative report describes reforms organized around Secure by Design, Secure by Default, and Secure Operations, including expanded phishing-resistant multifactor authentication and remediation of critical and high-risk open-source vulnerability instances. These are Microsoft's self-reported outcomes, and they say nothing specific about this Outlook bug.

This CVE shipped in the same release as a cluster of sibling Outlook remote code execution fixes (CVE-2026-123375 through CVE-2026-123384), all addressed by the November build.

References

• NVD entry for CVE-2026-123380
• CVE Record for CVE-2026-123380
• Microsoft Security Update Guide: CVE-2026-123380
• CIRCL Vulnerability Lookup: CVE-2026-123380
• Microsoft 365 Apps security updates release notes
• Release notes for Microsoft Office security updates
• Zero Day Initiative: The November 2026 Security Update Review
• Rapid7: Patch Tuesday November 2026
• BleepingComputer: Microsoft November 2026 Patch Tuesday coverage
• CISA: Adds Six Known Exploited Vulnerabilities to Catalog (November 10, 2026)
• OffSeq Threat Radar: CVE-2026-123380
• MITRE CWE-122: Heap based Buffer Overflow
• Microsoft Learn: Update Office LTSC 2024
• Microsoft Learn: Update Office LTSC 2021
• Update history for Office LTSC 2024 and Office 2024
• Office LTSC 2021 end of support announcement
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• DHS: Cyber Safety Review Board report release
• Microsoft SFI Progress Report July 2026
• Microsoft SFI July 2026 report (PDF)
• Radicati: Microsoft 365, Exchange Server and Outlook Market Analysis
• Microsoft 365 for enterprise overview