Brief Summary: Microsoft Outlook CVE-2026-123381 Stack-Based Buffer Overflow Leading to Remote Code Execution

Introduction

A memory corruption flaw in Microsoft Office Outlook, fixed on November 10, 2026, gives an unauthenticated attacker a path to code execution once a user opens a specially crafted file. The bug spans Microsoft 365 Apps for Enterprise as well as Office LTSC 2021 and Office LTSC 2024, so the fix touches both subscription and long-term servicing fleets. It shipped in the same release as a separate Outlook spoofing bug that is being exploited in the wild.

CVE-2026-123381 carries a Microsoft CNA CVSS 3.1 base score of 8.8 (High) and a Microsoft severity of Important. The two ratings come from different systems and do not conflict. At publication, Microsoft recorded the issue as not publicly disclosed and not exploited.

Technical Information

Root cause: a numeric conversion feeding a stack write

Microsoft describes the issue as a stack-based buffer overflow in Outlook that allows an unauthorized attacker to execute code over a network. The advisory assigns two weaknesses:

• CWE-121, Stack based Buffer Overflow: a write past the end of a buffer allocated on the stack. MITRE lists possible consequences including crashes, unauthorized code execution, and bypass of protection mechanisms. These consequences apply to the weakness class in general and do not describe behavior demonstrated against Outlook.
• CWE-681, Incorrect Conversion between Numeric Types: a conversion that omits data or yields an unexpected value. MITRE notes that using such values for resource allocation or security decisions can introduce vulnerabilities.

The usual way these two weaknesses combine is well understood. A length or count read from a file looks safe in its original type, then a cast (a sign change or a truncation) turns it into a wrong value, often a negative number that becomes very large when treated as unsigned. That value then drives a copy into a fixed-size stack buffer, and the write runs past its end. Microsoft has not published the vulnerable function, the parser involved, or how the conversion and the overflow connect in this specific code path. This pattern explains why the two CWEs appear together. It does not describe confirmed Outlook internals.

CVSS breakdown

Microsoft's base vector, as displayed by NVD (which lists the record as Awaiting Enrichment with no independent NVD score):

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector: Network.
• Attack Complexity: Low.
• Privileges Required: None. The attacker is unauthorized before the attack.
• User Interaction: Required. A user must open the attacker's file.
• Scope: Unchanged.
• Confidentiality, Integrity, Availability: High.

Microsoft also publishes a temporal score of 7.7:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

The temporal qualifiers are Unproven exploit maturity, Official Fix, and Confirmed report confidence. The base score of 8.8 remains the figure to report for severity.

"Privileges Required: None" describes what the attacker needs before the attack. It does not tell us the privilege level at which injected code would run, and the advisory does not state one.

Attack flow

Based on Microsoft's advisory and FAQ, the disclosed sequence is:

1. The attacker prepares a specially crafted file designed to trigger the flaw in Outlook.
2. The attacker delivers that file to a target over a network.
3. The user opens the file. Microsoft states this is required, and that the Preview Pane is not an attack vector, so simply previewing a message is not a confirmed trigger.
4. Outlook processes the attacker-controlled content, and the disclosed weaknesses (an incorrect numeric conversion and a stack-based overflow) result in memory corruption.
5. Successful exploitation can lead to code execution, with high potential impact to confidentiality, integrity and availability.

The public material does not provide a file extension, payload, overwrite offset, control flow technique, or reproducible exploit procedure, and we have not attempted to fill those gaps.

Exploitation status and the other Outlook bug

At original publication, Microsoft's exploitability table recorded "Publicly disclosed: No", "Exploited: No" and "Exploitation Less Likely", with exploit maturity Unproven (no public exploit code, or only a theoretical exploit). Microsoft credits Kentaro Kawane of GMO Cybersecurity by Ierae, Inc. for reporting the bug through coordinated disclosure. No threat actor, campaign or malware family is associated with this CVE in the reviewed material.

The November release also fixed CVE-2026-124194, which CISA added to its Known Exploited Vulnerabilities catalog on November 10, 2026 and which JPCERT reports Microsoft confirmed as exploited. That is a different bug. It is an Outlook spoofing issue (ZDI reports CVSS 6.5, Microsoft Moderate) where opening a crafted message file can cause a connection to an attacker-controlled server without the usual warning, potentially disclosing authentication credentials. Its mechanism and exploitation status should not be attributed to CVE-2026-123381. A higher severity score and confirmed attacker activity answer different questions: CVE-2026-123381 has the higher score, and CVE-2026-124194 is the one being exploited.

Patch Information

Microsoft fixed CVE-2026-123381 in its November 10, 2026 Patch Tuesday release. The MSRC advisory sets the Remediation Level to Official Fix, meaning a complete vendor fix rather than a workaround. Outlook is closed source, so there is no public commit or diff. The evidence comes from Microsoft's advisory, the Office security release notes, and NVD's copy of the CNA data.

Microsoft has not described the code change. Given the two CWEs, the fix most likely makes the numeric conversion safe (consistent types, or range checks before narrowing or sign changes) and validates the size against the destination buffer before copying. That is our inference. Microsoft has not said so.

The fix ships in the normal Click to Run Office servicing builds rather than as a standalone Outlook hotfix.

Fixed builds listed by MSRC (32-bit and 64-bit):

• Microsoft Office LTSC 2021: 16.0.14334.21048 (Version 2108)
• Microsoft Office LTSC 2024: 16.0.17932.21140 (Version 2408)
• Microsoft 365 Apps for Enterprise: per-channel builds listed at the Office Security Releases page

Microsoft 365 Apps builds published November 10, 2026 (the release notes list CVE-2026-123381 under the Outlook section):

• Current Channel: Version 2610, Build 20527.20196
• Monthly Enterprise Channel: Version 2610, Build 20527.20194; Version 2609, Build 20430.20264; Version 2608, Build 20326.20320
• Semi Annual Enterprise Channel: Version 2610, Build 20527.20192; Version 2609, Build 20430.20262; Version 2608, Build 20326.20318
• Office 2024 / Office 2021 Retail: Version 2610, Build 20527.20196

These are the security release builds for each servicing branch. Match the build to the channel actually in use rather than comparing against a build from a different branch.

Verifying the fix. There is no separate KB to look for. A device is patched when its Office build, shown under File > Office Account > About Outlook, matches or exceeds the fixed build for its channel.

Applying the update. Click to Run clients normally update themselves. To trigger an update manually on Windows, Microsoft documents:

1. Open an Office application.
2. Select File > Account, or Office Account in Classic Outlook.
3. Under Product Information, select Update Options > Update Now.
4. If Update Now is not available, select Enable Updates first.
5. Let Office finish checking for and installing updates.

If Update Options is missing, the installation may be volume licensed or managed through Group Policy. In that case, Microsoft's guidance is to try Microsoft Update or contact the help desk. Environments that pin versions through policy, Configuration Manager or Intune need to approve or deploy the November 2026 build for each channel in use.

For centrally managed Microsoft 365 Apps, Microsoft documents the Office Deployment Tool and Group Policy and recommends sourcing updates from the Office Content Delivery Network. Downloaded updates apply at the next opportunity, such as when Office applications close, and a configured update deadline can close applications automatically, which may cause data loss. A downloaded update is not the same as an installed one.

The advisory documents no workaround. MITRE's generic prevention guidance for CWE-121 and CWE-681 (bounds checking, compiler overflow detection, avoiding unnecessary conversions, range checks) is aimed at developers and is not a substitute for installing the update.

ZDI's November 2026 review lists CVE-2026-123381 among roughly a dozen Outlook remote code execution bugs fixed in this release.

Affected Systems and Versions

The CVE record lists three product families, each affected on both 32-bit and x64 systems:

• Microsoft 365 Apps for Enterprise: affected from 16.0.1. The upper bound in the record points to Office Security Releases rather than a single numeric build, so the fixed version depends on update channel and version (see the channel builds above).
• Microsoft Office LTSC 2021: versions from 16.0.1 before 16.0.14334.21048.
• Microsoft Office LTSC 2024: versions from 16.0.0 before 16.0.17932.21140.

NVD's copy of the CNA data matches these ranges for LTSC 2021 and LTSC 2024. The vulnerable configuration requires a user to open an attacker-supplied crafted file. The Preview Pane is not an attack vector.

Vendor Security History

The most relevant documented case is the Cyber Safety Review Board's review of the 2023 Exchange Online intrusion. The board reported that the attacker accessed some government mailboxes for at least six weeks and downloaded approximately 60,000 State Department emails, and that the State Department, not Microsoft, first detected the anomalous access. The board concluded that Microsoft's operational and strategic decisions reflected a culture that deprioritized enterprise security investment and rigorous risk management, and CRN's coverage recorded its finding that the intrusion was preventable. That was a cloud identity and email service incident and is unrelated to this CVE.

Microsoft's July 2026 Secure Future Initiative progress report frames its response around Secure by Design, Secure by Default and Secure in Operations. Microsoft reports 99.97% phishing-resistant MFA coverage for users and devices, and automated container patching that addresses roughly 3 million vulnerability instances each month. These are self-reported program metrics in identity and engineering operations. They say nothing about whether a particular Outlook installation has the November build, which remains the deciding question for this CVE.

References

• NVD entry for CVE-2026-123381
• CVE Record for CVE-2026-123381
• Microsoft Security Update Guide: CVE-2026-123381
• Release notes for Microsoft Office security updates
• Office Security Releases
• Zero Day Initiative: The November 2026 Security Update Review
• MITRE CWE 121: Stack based Buffer Overflow
• MITRE CWE 681: Incorrect Conversion between Numeric Types
• CISA: Adds Six Known Exploited Vulnerabilities to Catalog
• JPCERT/CC: Microsoft Releases November 2026 Security Updates
• BleepingComputer: Microsoft November 2026 Patch Tuesday coverage
• Orbitaley: Microsoft November 2026 fixes and exploited Outlook flaw
• Microsoft Support: How to update Microsoft 365 or Office for Windows
• Microsoft Learn: Keep Office apps up to date with the latest updates
• Cyber Safety Review Board: Review of the Summer 2023 Microsoft Exchange Online Intrusion
• CRN: coverage of the review board findings
• Microsoft Secure Future Initiative Progress Report, July 2026
• Microsoft 2026 Annual Report