Heap-based buffer overflow in Microsoft Office - CVE-2026-123383

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code with the victim user's privileges.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Outlook when an attachment copied from Outlook is processed by another application. A remote attacker can send a specially crafted email and convince a user to copy its attachment in Outlook to trigger code execution when another application processes the copied attachment.

The Preview Pane is not an attack vector for this vulnerability.

Affected software

How to mitigate CVE-2026-123383

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-123383
• https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office