CVE-2026-78525

CVE-2026-78525 is a use-after-free memory corruption flaw (CWE-416) in Microsoft Office Outlook that an unauthorized attacker can trigger over a network, per Microsoft's advisory; the CPE data also lists Word and the Office suites (2019, 2021, 2024, Microsoft 365 Apps), suggesting the vulnerable code affects shared Office components beyond Outlook alone. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates an attacker needs no privileges or special conditions but must get a user to interact, most plausibly by having them open crafted email content or a malicious document. Successful exploitation yields arbitrary code execution running with the victim's privileges, with high impact on confidentiality, integrity, and availability. Anyone running the affected Office/Outlook releases is potentially affected, with risk concentrated in environments where users routinely open email attachments or linked content. There is currently no public proof of concept, no CISA KEV listing, and EPSS assigns a modest 0.8% probability of exploitation within 30 days, so no active exploitation is confirmed.

What to do: Apply Microsoft's security update for the affected Office/Outlook builds as soon as it is available, prioritizing mail-reviewer and helpdesk workstations that open untrusted email and documents; check Microsoft's advisory for the exact fixed build numbers for each Office version since they are not listed in this data. In the interim, caution users against opening attachments or embedded content from unknown senders, and confirm remediation by verifying Outlook/Word build numbers against the advisory. No workarounds are specified in the source data.