Act nowDisclosed

Advisory · CVE-2026-97016

Heap overflow in Microsoft Outlook allows network code execution

Microsoft Office Outlook has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code, affecting Microsoft 365 Apps and Office LTSC lines. Microsoft rates it CVSS 3.1 9.8.

Advisory published October 13, 2026Independent summary
Vendor
Microsoft
Product
Microsoft Office Outlook
Identifier / CWE
CVE-2026-97016
CWE-122
Action timing
Immediate
ELI5

Explain it like I’m five

The mail client can be overflowed by content delivered over the network, which is another way of saying the inbox itself is the delivery mechanism.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Reach the component

    An unauthenticated attacker sends crafted network traffic to a Windows system running Microsoft Office Outlook.

  2. 02Memory flaw triggers

    The component mishandles the input and corrupts or reuses memory outside its intended bounds.

  3. 03Code runs

    The attacker gains code execution in the component's context on the target system.

What happened

Microsoft disclosed CVE-2026-97016 in its October 2026 update guide: a heap-based buffer overflow (CWE-122) in Microsoft Office Outlook lets an unauthorized attacker execute code over a network. Microsoft’s affected data covers Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024.

Microsoft lists the affected Windows releases in its update guide. Apply the October 2026 security updates for your release rather than relying on a version guess here.

What to do

  1. Inventory every Microsoft Office Outlook deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Microsoft Office Outlook while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for Outlook crashes tied to specific messages, and unexpected processes spawned under the mail client.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Client-side 9.8s are how patch backlogs become incidents. Push the Office updates with the OS ones and check crash reports for a pattern.