Microsoft November 2026 update fixes 1,093 flaws, one Outlook zero-day
Opening a crafted file can leak an NTLMv2 hash; the Preview Pane is not an attack vector.
74
Vulnerability1 · 1 read
CVE-2026-124227
Uninitialized resource use in Outlook allows remote code execution
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Microsoft Office Outlook uses an uninitialized resource, letting an unauthorized attacker execute code over the network. No privileges are required, but the victim must interact and the conditions are difficult to meet. Successful exploitation gives the attacker code execution on the affected system. Microsoft has not listed affected builds.
What to do: Apply Microsoft's update for CVE-2026-124227. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| Microsoft Office Outlook | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
- Weakness
- CWE-908
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H