CVE-2026-78520

Microsoft has disclosed an out-of-bounds read (CWE-125) in the Outlook component of Microsoft Office that an unauthenticated attacker can trigger over a network, with the vendor description stating that code execution is possible. The CVSS vector (AV:N/AC:L/PR:N/UI:R) shows the attack requires user interaction, most plausibly a user opening or previewing crafted content such as a malicious message or document, and the impact metrics rate confidentiality as high (C:H/I:N/A:N). The affected-product list spans the mainstream Office ecosystem — Microsoft 365 Apps, Microsoft 365, Office 2019, Office 2021, Office 2024, and Word — in addition to the Outlook component named in the description. As of the September 2026 Security Update Review there is no known exploitation, no public proof-of-concept, and no CISA KEV listing, with EPSS assigning only a 0.7% (52nd percentile) probability of exploitation within 30 days.

What to do: Apply Microsoft's September 2026 security updates for Office/Microsoft 365 — covering the Outlook component, Microsoft 365 Apps, Office 2019/2021/2024, and Word — on all endpoints, and verify both perpetual-license and Microsoft 365 Channels installs receive the fix. Because exploitation requires user interaction (UI:R), treat opening or previewing untrusted emails and documents as the primary risk path and reinforce user caution in the interim. With no KEV entry or public PoC, standard patch-cycle prioritization is reasonable, but monitor Microsoft's advisory for the specific fixed build numbers, which are not included in the source data.