CVE-2026-69629

CVE-2026-69629 is a heap-based buffer overflow (CWE-122) in Microsoft Office Outlook that a remote, unauthenticated attacker can trigger over a network. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates no privileges or credentials are needed on the attacker's side, but the victim must interact with attacker-controlled content — consistent with previewing or opening a specially crafted item in Outlook. A successful exploit lets the attacker execute code in the context of the Outlook user, with high impact on confidentiality, integrity, and availability (CVSS 8.8 High). All users running an affected Outlook build are exposed; effectively that means the very large installed base of Microsoft Office/Outlook users, although the provided data does not enumerate the exact affected versions or products beyond Office Outlook. There is no known public proof-of-concept, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and EPSS assigns a 0.8% probability of exploitation in the next 30 days (56th percentile), so no in-the-wild exploitation is currently known.

What to do: Apply Microsoft's security update for Outlook/Office addressing CVE-2026-69629 through Microsoft Update or your Microsoft 365 update channel as soon as it reaches your deployment ring, and verify the affected builds against Microsoft's advisory, since exact versions are not listed in this data. Until patched, reduce exposure by using plain-text reading mode and cautioning users against previewing or opening content from untrusted senders. With no public PoC, no KEV listing, and low EPSS, this can be handled in the normal high-priority patch cycle rather than as an emergency change.