Integer overflow in Microsoft Office - CVE-2026-123378
Published: November 11, 2026
Vulnerability identifier: #VU165474
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-123378
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the affected system.
The vulnerability exists due to integer overflow or wraparound in Microsoft Office Outlook when processing a large, specially crafted message. A remote attacker can deliver such a message and induce user interaction to execute arbitrary code.
Successful exploitation requires the targeted system to have sufficient available memory to process the specially crafted message.
Affected software
Microsoft Office
How to mitigate CVE-2026-123378
Install security update from vendor's website.
Microsoft Office - addressed in versions 16.0.14334.21048, 16.0.17932.21140