Path traversal in Microsoft Office - CVE-2026-124228

Vulnerability details

The vulnerability allows a remote user to execute arbitrary code with the victim user's permissions.

The vulnerability exists due to path traversal in Microsoft Office Outlook when synchronizing signature content to a user's desktop client. A remote user can submit specially crafted signature content over the network using access to the user's Outlook account to execute arbitrary code with the user's permissions.

Affected software

How to mitigate CVE-2026-124228

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-124228
• https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office