Type Confusion in Microsoft Office - CVE-2026-119993
Published: November 11, 2026
Vulnerability identifier: #VU165402
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-119993
CWE-ID: CWE-843
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose information from Microsoft Office Outlook application memory.
The vulnerability exists due to type confusion in Microsoft Office Outlook when accessing a resource using an incompatible type. A remote attacker can exploit this flaw over a network, with user interaction, to potentially read small portions of the application's memory.
The Preview Pane is not an attack vector for this vulnerability.
Affected software
Microsoft Office
How to mitigate CVE-2026-119993
Install security update from vendor's website.
Microsoft Office - addressed in versions 16.0.14334.21048, 16.0.17932.21140