Key points
- CVE-2026-70291 is rated critical with a CVSS score of 9.8 by the NVD.
- The flaw is a heap-based buffer overflow within Microsoft Office Outlook.
- Attackers can execute code over a network without prior authorisation.
Microsoft has disclosed a critical remote code execution vulnerability in Microsoft Office Outlook, identified as CVE-2026-70291. The issue stems from a heap-based buffer overflow that allows an unauthorised attacker to run arbitrary code over a network connection.
The National Vulnerability Database assigned the flaw a CVSS score of 9.8, classifying it as critical. According to the Microsoft Security Update Guide, the weakness allows an unauthorised attacker to execute code over a network.
Technical context
The vulnerability is categorised under CWE-122, which refers to heap-based buffer overflows. This type of memory corruption occurs when data exceeds the allocated space in the heap, potentially allowing an attacker to overwrite adjacent memory structures and control program execution flow.
Affected systems
Microsoft Office Outlook is the specific product affected by CVE-2026-70291. The advisory does not specify particular versions. The source material lists the product as affected but provides no further details on specific builds or configurations.
What happens next
No patch or update has been confirmed in the source material. Security teams should monitor for official vendor guidance. In the interim, organisations may consider restricting network access to Outlook services or implementing strict email filtering to reduce exposure to potentially malicious payloads that could trigger this overflow.
Why this attack works
Buffer overflows exploit poor memory management. Attackers send crafted data that exceeds buffer limits, overwriting adjacent memory. This allows them to hijack the execution flow. In intrusion stages, this often serves as an initial access vector or privilege escalation method. Teams usually monitor for anomalous memory access patterns or unexpected process spawning. Check whether your network segmentation limits exposure to untrusted inputs targeting mail clients.
What to do and how to stay safe: Microsoft
- Verify if your environment runs Microsoft Office Outlook and assess exposure to untrusted network traffic.
- Implement network segmentation to isolate email clients from critical internal systems.
- Monitor for unusual outbound connections or process executions that may indicate code execution.
- Await official vendor updates and apply them promptly once released.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-70291?
The NVD rates CVE-2026-70291 with a CVSS score of 9.8, which is considered critical.
What type of vulnerability is CVE-2026-70291?
It is a heap-based buffer overflow in Microsoft Office Outlook that allows remote code execution.
Is a fix available for this vulnerability?
The source material does not confirm the availability of a patch or update at this time.
