CVE-2026-70242

CVE-2026-70242 is a heap-based buffer overflow (CWE-122) in Microsoft Office Outlook. The flaw is scored CVSS 3.1 9.8 with network attack vector, low complexity, no privileges required, and no user interaction, so an unauthorized attacker can trigger it remotely over the network. Successful exploitation allows the attacker to execute code with high impact on confidentiality, integrity, and availability, scoped to the vulnerable component. Anyone running an affected Microsoft Outlook installation is potentially exposed, but the advisory data does not list specific version ranges. There is no known public proof of concept and the CVE is not in the CISA Known Exploited Vulnerabilities catalog, so exploitation is none known at this time.

What to do: Apply the latest Microsoft security updates for Outlook and Office as soon as they are available for your channel, and confirm the fix is installed via your patch-management console. Until patched, reduce exposure by limiting unsolicited network access to Outlook clients and treating unexpected mail or calendar content as untrusted. There is no public proof of concept and the issue is not listed in CISA KEV, but the critical unauthenticated network score means patching should be prioritized.