Introduction
Microsoft lists the Outlook Preview Pane as an attack vector for CVE-2026-110068, a use after free in Microsoft Office Outlook that can lead to code execution with the permissions of the user viewing a specially crafted email. Microsoft rates it Critical and shipped fixes on November 10, 2026. It also states that the bug was neither exploited nor publicly disclosed at release, so the work here is patch deployment, not incident response.
Technical information
Root cause: CWE-416, use after free
Microsoft classifies the bug as CWE-416, Use After Free. MITRE defines this weakness as referencing memory after it has been freed. Once freed, that memory can be handed to another allocation, so any later operation through the original (now dangling) pointer acts on data the code no longer owns. Depending on the circumstances, the consequences for this class range from corrupted data and crashes to information disclosure and arbitrary code execution.
That describes the weakness class in general. It is not a reconstruction of this specific Outlook defect. Outlook is closed source, and Microsoft has not published the vulnerable function, the object lifetime sequence, the allocation layout, or an exploit payload. Microsoft does state the outcome, which is that an unauthorized attacker can potentially execute code over a network through Microsoft Office Outlook. We did not find public vulnerable code for this CVE, so none is reproduced here.
Scoring breakdown
Microsoft is the scoring authority. NVD shows the record as Awaiting Enrichment, so the score displayed there is Microsoft's assessment, not an independent NIST one.
Base: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) Temporal: .../E:U/RL:O/RC:C (7.7)
- Attack Vector: Network. The vulnerable code is remotely reachable, in practice via email.
- Attack Complexity: Low. No specialized access conditions are assumed.
- Privileges Required: None. The attacker needs no account on the target system.
- User Interaction: Required. Some user action is part of the scored path.
- Scope: Unchanged. No change of security authority is claimed.
- Confidentiality, Integrity, Availability: High. Full compromise of what the user's context can reach.
- Temporal: E:U / RL:O / RC:C. Exploit maturity Unproven, Official Fix available, report Confirmed.
The Critical label and the 8.8 score (which NVD bands as High) do not contradict each other. Microsoft's Max Severity rating and the CVSS bands are separate scales, and the temporal 7.7 reflects exploit maturity and fix availability rather than a lower technical impact.
Attack flow
Based on Microsoft's advisory, the documented path looks like this:
- The attacker builds a specially crafted email intended to drive Outlook's message processing into the use after free condition.
- The attacker delivers the email over the network. No account on the affected system is required (PR:N).
- The user opens the message in Outlook, or the message is rendered in the Preview Pane, which Microsoft separately identifies as an attack vector.
- For this weakness class, exploitation generally depends on the freed memory being reused by another allocation so that operations through the stale pointer act on content the attacker influences. Microsoft has not described how this is achieved for this bug.
- On success, code runs with the permissions of the user running Outlook. Microsoft does not claim administrator or SYSTEM privileges.
The public record puts two limits on this picture. First, it does not explain exactly how the Preview Pane path satisfies the UI:R requirement, so it does not support a claim that message delivery alone is sufficient. Second, the vector is the message itself. This is not an attachment execution bug.
Patch information
Microsoft fixed CVE-2026-110068 on November 10, 2026, as part of that month's Patch Tuesday. Microsoft's CNA record tags the advisory as both a vendor advisory and a patch reference, and the temporal vector's RL:O (Remediation Level: Official Fix) means a complete vendor fix is available.
Fixed builds
The fix ships as a new Office build. Microsoft's security update table lists nine product and platform rows, all released November 10, 2026. Any build lower than the one listed is affected:
- Microsoft Office LTSC 2021 (32 bit and 64 bit):
16.0.14334.21048 - Microsoft Office LTSC 2024 (32 bit and 64 bit):
16.0.17932.21140 - Microsoft Office LTSC for Mac 2021:
16.115.26110837 - Microsoft Office LTSC for Mac 2024:
16.115.26110837 - Microsoft Office 365 for Mac:
16.115.26110837 - Microsoft 365 Apps for Enterprise (32 bit and 64 bit): no fixed build number. Microsoft points to Office Security Releases
Microsoft 365 Apps ships through several update channels, each with its own build numbers, which is why the CVE record's versionEndExcluding field for that product holds a URL instead of a version. To confirm a Microsoft 365 Apps install is patched, check the November 2026 entry for your channel (Current, Monthly Enterprise, Semi Annual) in the Microsoft 365 Apps security updates release notes. Do not substitute an LTSC build number for a Microsoft 365 Apps build. The three Mac products share one fixed build and link to the Office for Mac release notes.
When the briefing was compiled, the general Windows and Mac release histories retrieved did not yet show the November 10 entry, even though the CVE advisory already listed the updates. The builds above come from the CVE specific advisory.
What the fix changes
There is no public diff or commit, and Microsoft has not published root cause details beyond the CWE label. In general, a use after free fix in a message rendering path corrects object lifetime. The code stops using a freed object, for example by holding a reference until processing finishes, clearing a dangling pointer, or reordering teardown so a callback cannot reach freed memory. That is the usual fix for this class of bug, and it is not a confirmed description of Microsoft's change.
Why the Preview Pane matters for priority
ZDI's November review notes that bugs exploitable through the Preview Pane are the ones to deploy first, because the user never has to explicitly open anything. Since this bug can be triggered from the Preview Pane, the vulnerable code runs when a message is previewed. Microsoft provides no CVE specific workaround. Disabling the Preview Pane is at best a partial stopgap, and the build update is the real fix.
Installing the update
For Windows Office installations, Microsoft documents this process:
- Open a Microsoft 365 app, such as Word, and create a new document.
- Select File > Account (in classic Outlook this may appear as Office Account).
- Under Product Information, select Update Options > Update Now.
- If needed, select Enable Updates first, then Update Now.
If there is no Update Options entry and only an About button, the installation may be under volume licensing or company managed update policy. Microsoft's guidance in that case is to try Microsoft Update or contact your help desk. For Office for Mac, use Microsoft AutoUpdate through Help > Check for Updates in any Office application.
Exploitation status when the patch shipped
One upstream summary called this bug an actively exploited zero day. It is not. At publication Microsoft marked it Publicly Disclosed: No, Exploited: No, and Exploitation Less Likely, and ZDI's table agrees. The exploited Outlook zero day that BleepingComputer reported in the same release is a different bug, CVE-2026-124194, an Outlook spoofing flaw used to steal NTLM hashes. Make sure both fixes are installed, and keep the two CVEs separate in tracking and reporting. No threat actor, campaign, or indicators are tied to CVE-2026-110068 in the sources we reviewed.
The researcher tiebuchen is credited with reporting CVE-2026-110068.
Affected systems and versions
Per Microsoft's security update table, the following are affected:
- Microsoft Office LTSC 2021, Windows, 32 bit and 64 bit editions: builds below
16.0.14334.21048 - Microsoft Office LTSC 2024, Windows, 32 bit and 64 bit editions: builds below
16.0.17932.21140 - Microsoft Office LTSC for Mac 2021: builds below
16.115.26110837 - Microsoft Office LTSC for Mac 2024: builds below
16.115.26110837 - Microsoft Office 365 for Mac: builds below
16.115.26110837 - Microsoft 365 Apps for Enterprise, 32 bit and 64 bit systems: builds prior to the November 2026 security release for the relevant update channel
Outlook is also available through other clients, including mobile apps, but the advisory's update matrix covers only the products above. We do not assume that every Outlook platform is affected.
Vendor security history
Microsoft's broader track record is relevant context for how much weight to place on its processes, but it is not evidence about this specific bug.
- 2023 Exchange Online intrusion. The Cyber Safety Review Board's review of the summer 2023 incident describes activity by Storm-0558, assessed as affiliated with the People's Republic of China and pursuing espionage objectives, using authentication tokens signed with a Microsoft key. The Board found the intrusion preventable, concluded that Microsoft's security culture was inadequate and required an overhaul, and criticized Microsoft for relying on a customer to report anomalies. Storm-0558 is not linked to CVE-2026-110068.
- Secure Future Initiative. Microsoft's November 2025 SFI progress report describes expanded security governance, tighter production code signing controls, continuous remediation of secrets in code, and governed templates used by 94% of release pipelines. These are Microsoft reported figures, not an independent validation of this fix.
- Market position. The European Commission described Office 365 and Microsoft 365 as widely used business productivity suites and reported a preliminary finding that Microsoft holds a dominant position in professional SaaS productivity applications, including Outlook. That finding is preliminary, not a final ruling, but it explains why Office update processes carry so much operational weight.
References
- NVD: CVE-2026-110068
- CVE record for CVE-2026-110068 (CVE Services API)
- Microsoft Security Update Guide: CVE-2026-110068 Microsoft Office Outlook Remote Code Execution Vulnerability
- Zero Day Initiative: The November 2026 Security Update Review (thezdi.com)
- Zero Day Initiative: The November 2026 Security Update Review (zerodayinitiative.com)
- BleepingComputer: Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero day
- BleepingComputer (www mirror of the same article)
- MITRE CWE-416: Use After Free
- Microsoft Learn: Microsoft 365 Apps security updates release notes
- Microsoft Learn: Release notes for Office for Mac
- Microsoft Office Security Releases
- Microsoft Support: How to update Microsoft 365 or Office for Windows
- Microsoft Outlook product page
- CISA Known Exploited Vulnerabilities Catalog
- Cyber Safety Review Board: Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft Trust Center: SFI Progress Report November 2025
- European Commission press release IP/25/2048
