Brief Summary: Microsoft Outlook CVE-2026-123383 Heap-Based Buffer Overflow Enabling Remote Code Execution

Introduction

A heap-based buffer overflow in Microsoft Office Outlook, fixed in the November 10, 2026 Patch Tuesday release, can let a remote attacker run code on a workstation once a recipient copies an attachment from a crafted email. Because the delivery mechanism is simply an email sent to the target, this bug deserves a place in Office patch planning even though Microsoft rates it Important and reports no exploitation.

Technical information

Classification and scoring

Microsoft classifies CVE-2026-123383 as CWE-122: heap-based buffer overflow in Microsoft Office Outlook, with a CVSS 3.1 base score of 8.8 and a temporal score of 7.7. The vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Broken down:

• AV:N: the attack is network reachable (the payload arrives by email).
• AC:L: low attack complexity.
• PR:N: no privileges are required on the target.
• UI:R: the victim must take an action.
• S:U: scope is unchanged.
• C:H / I:H / A:H: high impact to confidentiality, integrity, and availability.

NVD has the record marked as Awaiting Enrichment. The 8.8 High score it displays is Microsoft's CNA assessment, not an independent NIST score.

Root cause

Outlook is closed source, and Microsoft has published no commit, diff, or code-level description of the defect or the fix. What the advisory does tell us is where the flaw is reached. The overflow is tied to Outlook's handling of an attachment that the user copies, and to the processing of that copied attachment by another application. That places the vulnerable logic in the path that copies the attachment and hands it off, rather than in message rendering. Heap overflow fixes generally add length or size checks or correct how a destination buffer is sized before data is written, but Microsoft has not confirmed that this is what changed here, so treat it only as general background.

Attack flow

Based on the advisory FAQ, exploitation proceeds as follows:

1. The attacker crafts an email carrying a malicious attachment and sends it to the target. No authentication or privileges on the target system are needed.
2. The attacker persuades the recipient to copy the attachment in Outlook. This is the user interaction captured by UI:R.
3. Another application processes the copied attachment.
4. The heap-based buffer overflow is triggered, and successful exploitation can execute code with the recipient's privileges.

Two points matter for risk assessment. First, Microsoft explicitly states that the Preview Pane is not an attack vector, so viewing the message is not described as sufficient. Second, the resulting code runs in the user's context, so the blast radius tracks the privileges of the targeted account.

Exploitation status

Microsoft's advisory lists the issue as not publicly disclosed, not exploited, and Exploitation Less Likely. ZDI's November 2026 review gives the same status. BleepingComputer's November 2026 Patch Tuesday coverage, whose headline references an Outlook zero day, lists CVE-2026-123383 as an Important Outlook remote code execution issue but provides no evidence that this specific CVE has been exploited and names no threat actor. We found nothing in the source material supporting active exploitation, a campaign, or attribution for this CVE.

Patch information

Microsoft fixed CVE-2026-123383 in its November 10, 2026 Patch Tuesday release. The MSRC advisory (revision 1.0, published the same day) sets the CVSS temporal Remediation Level to Official Fix, meaning a complete vendor patch is available.

Fixed builds

The MSRC Security Updates table lists the following, all dated Nov 10, 2026 and rated Important / Remote Code Execution:

• Microsoft Office LTSC 2024 (32-bit and 64-bit): fixed in 16.0.17932.21140
• Microsoft Office LTSC 2021 (32-bit and 64-bit): fixed in 16.0.14334.21048
• Microsoft 365 Apps for Enterprise (32-bit and 64-bit): channel specific (see Office Security Releases)

The NVD record, sourced from Microsoft's CNA data, gives the same boundaries.

Reading the Microsoft 365 Apps entry

Microsoft 365 Apps is serviced through channels rather than a single build, which is why MSRC points to the Office security release notes. The November 10, 2026 release notes list CVE-2026-123383 among the fixes. A text extraction of that page gave these patched builds. Verify them against the page before relying on them:

• Current Channel: Version 2610 (Build 20527.20196)
• Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
• Office LTSC 2024 Volume Licensed: Version 2408 (Build 17932.21140)
• Office LTSC 2021 Volume Licensed: Version 2108 (Build 14334.21048)

The LTSC builds match the MSRC numbers once the 16.0. prefix is dropped, so the two sources agree.

Delivery and verification

There is no separate Outlook hotfix. The fix ships inside the normal Office Click to Run monthly security build, so Outlook is patched when the Office installation moves to one of the builds above. To confirm, check the Office build number under File > Office Account > About Outlook and compare it to the lists above.

Microsoft provides no separate workaround or mitigation for this CVE. Since the Preview Pane is not an attack vector, disabling it is not presented as a fix.

ZDI's November 2026 review lists CVE-2026-123383 as one of about 18 Outlook remote code execution CVEs fixed in this release. The same cumulative Office build that fixes this CVE also covers the others.

Affected systems and versions

• Microsoft Office LTSC 2024, 32-bit and 64-bit: versions below 16.0.17932.21140
• Microsoft Office LTSC 2021, 32-bit and 64-bit: versions below 16.0.14334.21048
• Microsoft 365 Apps for Enterprise, 32-bit and 64-bit: builds below the channel-specific fixed builds published in the Office security release notes (for example, Current Channel builds before Version 2610 Build 20527.20196)

The vulnerable configuration is a standard Outlook installation on one of these products. No special configuration is described as required beyond the user copying a crafted attachment.

Vendor security history

The Microsoft Security Response Center is Microsoft's hub for vulnerability reporting, security updates, and coordinated response. Microsoft's November 2025 Secure Future Initiative progress report states that 98% of production infrastructure was centrally tracked with logs retained for two years, and that more than 50 new detections were deployed across Microsoft infrastructure. These are Microsoft-reported program measures and do not establish a comparative security record. Within Outlook specifically, ZDI counts roughly 18 remote code execution CVEs fixed in the November 2026 release alone, CVE-2026-123383 among them.

References

• Microsoft Security Update Guide: CVE-2026-123383
• NVD: CVE-2026-123383
• Microsoft 365 Apps Security Updates (release notes)
• Microsoft Office Security Releases
• ZDI: The November 2026 Security Update Review
• BleepingComputer: Microsoft November 2026 Patch Tuesday coverage
• OffSeq Threat Radar: CVE-2026-123383
• Microsoft Security Response Center
• Microsoft Secure Future Initiative: November 2025 Progress Report
• Microsoft Annual Report 2026
• CISA Known Exploited Vulnerabilities Catalog