Brief Summary: Microsoft Outlook CVE-2026-123382 Untrusted Pointer Dereference Remote Code Execution

Introduction

Microsoft's November 2026 Patch Tuesday shipped a fix for a remote code execution flaw in Microsoft Office Outlook that an unauthenticated attacker can trigger by getting a user to open a specially crafted file. With a CVSS 3.1 base score of 8.8 and affected builds across Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, CVE-2026-123382 is a fix that most Windows enterprise fleets will need to verify, even though Microsoft reported no exploitation at publication.

The input data for this CVE listed the vendor as unknown. The CVE record resolves that: the vendor is Microsoft, and Microsoft Corporation is the assigning CNA. This bug should also be kept separate from CVE-2026-124194, a different Outlook vulnerability released the same day that was exploited in the wild. We cover that distinction below, because the two are easy to conflate in Patch Tuesday headlines.

Technical information

Root cause: CWE-822, Untrusted Pointer Dereference

Microsoft describes the flaw as an untrusted pointer dereference in Microsoft Office Outlook that allows an unauthorized attacker to execute code over a network. The assigned weakness is CWE-822, which is distinct from the heap buffer overflow class seen in some other Outlook vulnerabilities.

MITRE defines CWE-822 as a product obtaining a value from an untrusted source, converting that value to a pointer, and then dereferencing it. Depending on how the resulting pointer is used, the weakness class can permit:

reads of sensitive memory
unexpected termination
modification of critical program state
code execution, or calls to arbitrary functions

Those are general consequences of the weakness class. They are not a reconstruction of this specific Outlook bug. Microsoft has not identified the vulnerable Outlook function, the file field that carries the pointer value, the memory layout involved, or the manipulation sequence. Outlook is closed source, so there is no public commit or diff to inspect. The core disclosed defect is that Outlook trusts a pointer value that an attacker can influence.

CVSS assessment

Microsoft publishes the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Reading the base metrics through Microsoft's own explanations:

Attack Vector: Network (AV:N). The vulnerable component is reachable remotely.
Attack Complexity: Low (AC:L). No specialized access conditions or extenuating circumstances are required.
Privileges Required: None (PR:N). The attacker needs no prior authorized access.
User Interaction: Required (UI:R). A user must take an action before exploitation succeeds.
Scope: Unchanged (S:U). Impact stays within the same security authority.
Confidentiality, Integrity, Availability: High (C:H/I:H/A:H). Potential total loss in each dimension within the impacted component.

The temporal metrics bring the score from 8.8 down to 7.7: exploit maturity is Unproven (E:U), remediation level is Official Fix (RL:O), and report confidence is Confirmed (RC:C). Microsoft's own maximum severity rating is Important, which is a separate scale from CVSS. High potential impact and a lower exploitability assessment answer different questions, so they do not contradict each other.

Attack flow

Based on what Microsoft has disclosed, the exploitation path looks like this:

The attacker prepares a specially crafted file. The file type and extension have not been disclosed.
The attacker gets that file to the target over a network, consistent with AV:N. The specific delivery protocol has not been disclosed.
The user opens the file. Microsoft states that the user must open a specially crafted file from the attacker to initiate remote code execution, and that the Preview Pane is not an attack vector. Receiving or previewing a message alone is not described as a trigger.
While processing the file, Outlook derives a pointer from attacker-influenced data and dereferences it without establishing that the value is trustworthy (the CWE-822 condition).
Microsoft classifies the outcome as remote code execution. The privilege context in which attacker code runs has not been published. PR:N describes what the attacker needs beforehand, not what the resulting code obtains.

What remains unknown from public material: the vulnerable code path, the exact crafted file format, the execution privilege context, and any public exploit walkthrough. Those gaps limit exploit reconstruction, but they do not block remediation.

Exploitation status, and a common mix-up

At original publication, Microsoft's advisory recorded:

Exploited: No
Publicly disclosed: No
Exploitability assessment: Exploitation Less Likely

The E:U temporal metric is consistent with that. Microsoft's definition applies when publicly available exploit code is absent or exploitation is theoretical. These are publication-time assessments and do not guarantee anything about future activity. In the material we reviewed, there was no threat actor attribution, no target-specific exploit, no malicious file hashes, and no campaign infrastructure tied to this CVE.

The Outlook zero day from the same Patch Tuesday is CVE-2026-124194, a spoofing vulnerability. Qualys describes it as a crafted message file that causes Outlook to connect to an attacker-controlled location without the usual external content warning, potentially exposing authentication information. CISA added CVE-2026-124194 to the Known Exploited Vulnerabilities catalog on November 10, 2026 with a due date of November 24, 2026. That exploitation status, KEV listing, and deadline belong to CVE-2026-124194, not to CVE-2026-123382.

Microsoft credits Kentaro Kawane with GMO Cybersecurity by Ierae, Inc. for reporting CVE-2026-123382. That is researcher credit, not attacker attribution.

Patch information

Microsoft released the fix on November 10, 2026 as part of the November 2026 Patch Tuesday. The repair ships inside new Office builds rather than as a separate hotfix. What we can confirm comes from the Security Update Guide (SUG), its affected-product API, NVD, and the Office security release notes.

What the vendor says about the fix

The temporal vector ends in RL:O, Remediation Level: Official Fix, which Microsoft describes as a complete vendor solution being available. This is why the temporal score is 7.7 while the base score is 8.8.
In the SUG API, every affected product row has "productStatus":"fixed" and "customerActionRequired":true. The fix exists, but a machine stays vulnerable until it is running the new build.
Microsoft has not explained the code change. For CWE-822 in general, a fix usually stops the application from using a pointer value that comes from, or is influenced by, attacker-supplied data until it has been checked or replaced with a trusted internal reference. That describes how this bug class is generally fixed. It is not a confirmed account of Microsoft's change.

Fixed builds by product

The SUG lists six product and architecture rows for this CVE, all with a release date of November 10, 2026:

Microsoft Office LTSC 2024 (x86, x64): affected from 16.0.0 to before 16.0.17932.21140; fixed build 16.0.17932.21140.
Microsoft Office LTSC 2021 (x86, x64): affected from 16.0.1 to before 16.0.14334.21048; fixed build 16.0.14334.21048.
Microsoft 365 Apps for Enterprise (x86, x64): affected from 16.0.1 to the build listed for your update channel.

For Microsoft 365 Apps, the SUG does not give one version number. Its fixedBuildNumber field points to the Office security release notes, because the fixed build depends on the update channel. The release notes for November 10, 2026 list CVE-2026-123382 under the Outlook heading with these builds:

Current Channel: Version 2610 (Build 20527.20196)
Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
Semi Annual Enterprise Channel (receives Monthly Enterprise Channel builds): Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
Office 2024 Retail / Office 2021 Retail: Version 2610 (Build 20527.20196)
Office LTSC 2024 Volume Licensed: Version 2408 (Build 17932.21140)
Office LTSC 2021 Volume Licensed: Version 2108 (Build 14334.21048)

The LTSC numbers in the release notes match the SUG and NVD exactly, which makes them a reliable reference point when checking machines.

How the patch is delivered

These are Click to Run Office products, so there is no separate KB .msp file for Outlook. The fixed code is part of the monthly Office build. A machine counts as patched once it reports the listed build number, or a later one in the same version branch. Versions are usually shown as 16.0.<build>, so 17932.21140 appears as 16.0.17932.21140.

Microsoft Support documents the manual update path for Microsoft 365 or Office on Windows:

Open an Office application, such as Word, and create a new document.
Select File > Account, or Office Account in Classic Outlook.
Under Product Information, select Update Options > Update Now.
If necessary, select Enable Updates first.
Let the check and installation finish. Completion messages include You're up to date! and Updates were installed.

If Update Options is missing and only About appears, Microsoft says the installation may be volume licensed or managed through Group Policy, and the documented next steps are to try Microsoft Update or contact the company help desk. To confirm the installed version, use File > Account and the About section under Product Information.

Microsoft provides no vulnerability-specific workaround in the advisory. Disabling the Preview Pane is not a mitigation here, since Microsoft states the Preview Pane is not the attack vector.

A note on Office 2019

The November release notes also list an Office 2019 Volume Licensed build (1808, Build 10417.20236). However, the SUG rows for this CVE do not include Office 2019 as an affected product. Do not assume Office 2019 needs this particular fix unless Microsoft updates the advisory.

Revision history

The advisory is at revision 1.0 (November 10, 2026, Information published). Microsoft has not changed or released the fix again since publication.

Affected systems and versions

Per the CVE record, NVD, and the SUG affected-product rows:

Microsoft Office LTSC 2024, 32-bit (x86) and x64: versions 16.0.0 up to, but not including, 16.0.17932.21140
Microsoft Office LTSC 2021, 32-bit (x86) and x64: versions 16.0.1 up to, but not including, 16.0.14334.21048
Microsoft 365 Apps for Enterprise, 32-bit (x86) and x64: versions from 16.0.1 up to the channel-specific fixed build listed in the Office security release notes (see Patch information above)

The vulnerable configuration requires a user on an affected build to open an attacker-supplied crafted file. The product records use a default status of unknown, so these entries should not be expanded into a broader list of affected or unaffected editions. Office 2019 is not listed as affected for this CVE.

Vendor security history

Microsoft's footprint is broad. In its May 14, 2026 announcement of an investigation into Microsoft's business software ecosystem, the UK Competition and Markets Authority described more than 15 million commercial users across that ecosystem. That figure is not an Outlook user count, and the announcement opens an investigation rather than reporting any finding.

The most relevant documented failure in the briefing is the summer 2023 Exchange Online intrusion. The Cyber Safety Review Board found that Storm-0558 used an acquired Microsoft consumer token-signing key to forge authentication tokens and access email accounts. The Board concluded the intrusion should never have happened and resulted from a cascade of Microsoft security failures, criticizing decisions that reflected insufficient priority on enterprise security investment and rigorous risk management. That incident is a historical cloud identity case and has no link to CVE-2026-123382.

Microsoft's stated response is the Secure Future Initiative. Its July 2026 progress report describes Secure by Design, Secure by Default, and Secure in Operations as guiding principles, reports broadly enforced source code access controls, and self-reports that 93% of critical and high-value build pipelines use centrally governed templates. This is evidence of reported process change, not independent proof about any specific Office defect. For this CVE, the actionable evidence remains the product-specific advisory and the fixed build numbers.

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical information