Introduction
A heap buffer overflow in Microsoft Office Outlook, patched on November 10, 2026, lets an attacker-controlled server execute code on a connecting client at the moment Outlook processes the server's response. The flaw has a CVSS 3.1 base score of 8.8, and its affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. That covers the Outlook clients most enterprise fleets run today, even though no exploitation has been reported.
The input record listed the vendor as unknown. The MSRC advisory and NVD entry identify it as Microsoft Corporation. Microsoft rates the issue Important, and NVD displays Microsoft's score as High while its own assessment is pending.
Technical information
Root cause
Microsoft classifies CVE-2026-123384 as CWE-122: Heap based Buffer Overflow. MITRE defines this weakness as writing beyond the end of a buffer allocated on the heap. That kind of write can corrupt adjacent heap memory, and at the weakness-class level it can produce anything from a crash to arbitrary code execution. Those are general properties of the class. They are not a published reconstruction of this specific Outlook bug.
Microsoft's CVE-specific description states the consequence directly: an unauthorized attacker can execute code over a network. The advisory FAQ narrows where the bug lives. The overflow occurs when the Outlook client processes a response from a server the user has connected to, which places the defect in client code that parses server responses into heap buffers.
Microsoft also states that the Preview Pane is not an attack vector. For threat modeling and for remediation, this means the vulnerable code is not in the preview rendering path, and any preview-based attack narrative would contradict the advisory.
Outlook is closed source, so there is no public commit, diff, or root-cause write-up. The advisory does not identify the vulnerable function, the protocol, the response format, the memory layout, or the privilege level at which resulting code executes. We therefore cannot say whether execution would occur with administrative or system privileges, and we will not speculate about it.
CVSS breakdown
The published base vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Microsoft's full vector appends temporal metrics:
E:U/RL:O/RC:C
Those temporal metrics (Unproven exploit maturity, Official Fix, Confirmed report confidence) lower the temporal score to 7.7 without changing the 8.8 base score.
- Attack Vector: Network. The attack reaches the client through a network interaction.
- Attack Complexity: Low.
- Privileges Required: None. The attacker needs no existing privileges in the assessed scenario.
- User Interaction: Required. The user must connect the client to the malicious server.
- Scope: Unchanged.
- Confidentiality, Integrity, Availability: High. The consequences go well beyond information disclosure.
For prioritization, the attack is reachable over the network but still needs the user to connect to the malicious server. That required connection is a material prerequisite.
Attack flow
Based on Microsoft's documented scenario, exploitation proceeds as follows:
- The attacker hosts a malicious server.
- The attacker convinces a user to connect an affected Outlook client to that server.
- The server returns a crafted response.
- The Outlook client processes the response, the heap buffer overflow occurs, and code can execute on the client system.
No public proof of concept, exploit payload, or protocol-level detail accompanies this scenario.
Exploitation status
At publication, Microsoft's assessment was "Publicly disclosed: No", "Exploited: No", and "Exploitation Less Likely", with exploit code maturity rated Unproven. OffSeq's Threat Radar likewise describes the vulnerability as not known to be exploited, with no indexed public exploit in Metasploit or Exploit DB and no indexed public Nuclei template. That reflects only what the service can see. It does not prove that no private exploit exists. The reviewed CISA Known Exploited Vulnerabilities catalog does not list this CVE.
No threat actor attribution, campaign, victim set, or CVE-specific indicators of compromise were identified. Microsoft credits jmini and boolgombear in its acknowledgements. These are research credits, not attacker attribution.
Don't confuse this bug with CVE-2026-124194, a separate Outlook spoofing vulnerability in the same November 2026 release that was reported as actively exploited and added to CISA KEV on November 10, 2026. ZDI describes that issue as a crafted message file causing Outlook to contact an attacker-controlled location without the usual external content warning, exposing the user's NTLMv2 hash. In the same ZDI review, CVE-2026-123384 appears separately as an 8.8 RCE marked Exploited: No. The higher base score belongs to this heap overflow; the observed exploitation belongs to the spoofing bug. Neither the technique nor the exploitation status should be transferred between them.
Patch information
Microsoft fixed CVE-2026-123384 in its November 10, 2026 Patch Tuesday release. The MSRC advisory sets the CVSS temporal Remediation Level to Official Fix (RL:O), which is why the temporal score drops from 8.8 to 7.7.
What the fix changes
Because Outlook is closed source, we cannot see the change itself. Microsoft's FAQ tells us the fix sits in the client code that processes server responses. Fixes for CWE-122 bugs usually add a bounds or length check before data is copied into a heap allocation, or size the allocation from the data that actually arrives. Microsoft has not confirmed which approach it used here. Since the Preview Pane is not an attack vector, the fixed code is not in the preview rendering path.
Fixed builds
The fix ships as updated Office builds, not as a separate Outlook package. Builds below these are vulnerable:
- Office LTSC 2024 (32 and 64 bit), Version 2408: 16.0.17932.21140
- Office LTSC 2021 (32 and 64 bit), Version 2108: 16.0.14334.21048
- Microsoft 365 Apps for Enterprise (32 and 64 bit): November 2026 channel build (see below)
For Microsoft 365 Apps, MSRC does not list a single build number. It points to the Office security release notes (aka.ms/OfficeSecurityReleases), because the fixed build depends on the update channel. The November 10, 2026 release notes list:
- Current Channel: Version 2610, Build 20527.20196
- Monthly Enterprise Channel: Version 2610 (Build 20527.20194), Version 2609 (Build 20430.20264), Version 2608 (Build 20326.20320)
- Semi Annual Enterprise Channel builds: Version 2610 (Build 20527.20192), Version 2609 (Build 20430.20262), Version 2608 (Build 20326.20318)
- Office 2024 / 2021 Retail: Version 2610, Build 20527.20196
These channel builds were extracted from the release notes page with an automated query, so check them against the live page before using them as compliance thresholds. Do not borrow an LTSC build number to evaluate a Microsoft 365 Apps install, and do not assume one LTSC baseline covers the other release.
Delivery and verification
All affected products are Click to Run installs. The fix arrives through Office's normal update channel (Office CDN, Microsoft Intune or Configuration Manager, or a WSUS-managed Click to Run setup), not through a Windows KB. To confirm a machine is patched, compare its Office build (File > Office Account > About Outlook, or the VersionToReport value under the Click to Run configuration registry key) against the builds above. The installed build must be equal to or higher than the fixed build for its channel. Because the fix lives in shared Office binaries, Outlook must be restarted after the update.
The reviewed Microsoft advisory provides no CVE-specific workaround or mitigating configuration. Disabling the Preview Pane is not a mitigation for this CVE, and we are not aware of any verified registry, port blocking, or filtering control that substitutes for the update.
Affected systems and versions
Combining Microsoft's product list with NVD's version boundaries:
- Microsoft Office LTSC 2021, 32 bit and 64 bit: 16.0.1 up to, but not including, 16.0.14334.21048
- Microsoft Office LTSC 2024, 32 bit and 64 bit: 16.0.0 up to, but not including, 16.0.17932.21140
- Microsoft 365 Apps for Enterprise, 32 bit and 64 bit: NVD starts the affected range at 16.0.1 and defers to Microsoft's Office security release notes for the fixed build, which varies by channel
All listed entries classify the impact as remote code execution with Important severity. Outlook on Mac, mobile, and the web is not part of this advisory's affected product list.
Vendor security history
The most significant independent assessment of Microsoft's recent security record is the Cyber Safety Review Board's review of the Summer 2023 Exchange Online intrusion. In May and June 2023, the actor tracked as Storm-0558 compromised Exchange Online mailboxes at 22 organizations and of over 500 individuals, using authentication tokens signed with a Microsoft key created in 2016 combined with another authentication flaw. The Board concluded that the intrusion was preventable, that Microsoft's security culture required an overhaul, that Microsoft relied on a customer to detect the anomaly, and that it failed to promptly correct inaccurate public statements.
Microsoft launched its Secure Future Initiative (SFI) in November 2023, covering identity protection, system isolation, networks, engineering systems, threat monitoring, and faster response and remediation. Its July 2026 progress report describes embedding Zero Trust principles into platforms, engineering pipelines, and governance. These are Microsoft's own descriptions of its progress.
None of this is linked to CVE-2026-123384. The CSRB findings concern a historical cloud email incident, and SFI is a vendor program, not independent validation of this particular Outlook patch. Evaluate this advisory and its fixed builds on their own evidence.
References
- MSRC Security Update Guide: CVE-2026-123384, Microsoft Office Outlook Remote Code Execution Vulnerability
- NVD: CVE-2026-123384
- CVE Record: CVE-2026-123384
- Microsoft Learn: Release notes for Microsoft Office security updates
- MITRE CWE-122: Heap based Buffer Overflow
- CISA Known Exploited Vulnerabilities Catalog
- OffSeq Threat Radar: CVE-2026-123384
- Zero Day Initiative: The November 2026 Security Update Review
- CSRB: Review of the Summer 2023 Microsoft Exchange Online Intrusion
- DHS: Cyber Safety Review Board Releases Report on Microsoft Online Exchange Incident
- Microsoft Trust Center: SFI Progress Report July 2026
- Microsoft Learn: Secure Future Initiative overview
- Microsoft 365: Outlook for Business
