Heap-based buffer overflow in Microsoft Office - CVE-2026-97016

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the recipient's system.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Outlook when rendering email messages in the Outlook Reading Pane. A remote attacker can send a specially crafted email message to execute arbitrary code on the recipient's system.

Exploitation does not require the recipient to open the message or click anything in it.

Affected software

How to mitigate CVE-2026-97016

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97016
• https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office