CVE-2026-70291: Heap buffer overflow RCE in Microsoft Outlook · ZeroHour

CVE-2026-70291

mass

Heap buffer overflow RCE in Microsoft Outlook

CVSS 3.1

9.8 critical

EPSS

—

Published

Oct 13, 2026 (3d ago)

Modified

Oct 15, 2026

AI analysis

CVE-2026-70291 is a heap-based buffer overflow (CWE-122) in Microsoft Office Outlook. Microsoft rates it critical (CVSS 3.1 9.8) with network attack vector, low complexity, no privileges required, and no user interaction, so a remote attacker can trigger the flaw without authenticating. Successful exploitation allows arbitrary code execution with high impact to confidentiality, integrity, and availability, scoped to the vulnerable Outlook component. Anyone running an affected Outlook build is potentially exposed; the advisory data does not name specific versions. It is not on the CISA Known Exploited Vulnerabilities list, and no public proof-of-concept is known.

What to do: Apply the Microsoft security updates for Outlook as soon as they are published through Microsoft Update or your enterprise patch channel. Until patched, reduce exposure by blocking or sandboxing untrusted email and attachments at the mail gateway and monitoring Outlook processes for unexpected crashes or code execution. Confirm whether this CVE is listed in your current Microsoft Security Update Guide entry before treating a given build as fixed.

Affected

Microsoft Office Outlook

—

Estimated exposure

massHundreds of millions of Outlook users (order-of-magnitude; exact affected builds unknown) — Outlook ships with Microsoft 365 and Office, which have on the order of hundreds of millions of commercial and consumer users worldwide; no product-specific install count or version range was given in the advisory data.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Vendors: microsoft
Products: 365 apps, microsoft 365, office 2021, office 2024
Weakness: CWE-122
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-70291

In the news1 stories

The October 2026 Security Update Review