Use of uninitialized resource in Microsoft Office - CVE-2026-124227

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the affected system.

The vulnerability exists due to use of an uninitialized resource in Microsoft Office Outlook when processing a malicious Office file. A remote attacker can send a specially crafted Office file to a user and convince them to open it to execute arbitrary code.

Successful exploitation depends on specific memory conditions in the affected application that the attacker cannot fully control, making exploitation unreliable.

Affected software

How to mitigate CVE-2026-124227

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-124227
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124227

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office