high · CVSS v3 7.5
CVE-2026-108448
A heap-based buffer overflow in Microsoft Outlook can be triggered by an attacker over the network, enabling remote code execution. The flaw
Overview
A heap-based buffer overflow in Microsoft Outlook can be triggered by an attacker over the network, enabling remote code execution. The flaw exists in the handling of certain message types or attachments. It allows attackers to run arbitrary code on the victim's machine without authentication.
Description
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Impact
The vulnerability compromises confidentiality, integrity, and availability of affected systems. Attackers can gain full control of the victim's machine, potentially exfiltrating data or spreading malware. End‑users and organizations using Outlook are directly impacted, especially those with exposed mail servers.
Remediation
Apply the latest Microsoft Outlook security update (KBxxxxxx) immediately. Keep Outlook and the operating system fully patched. Configure email filtering to block suspicious attachments and enable safe attachment handling. Use network segmentation and least privilege for mail servers.
Risk context
The CVSS v3 score of 7.5 indicates a high severity, but no EPSS data is available. Defenders should treat this as a moderate‑to‑high urgency issue and prioritize patching Outlook installations.
Affected products
- Microsoft Outlook 2010
- Microsoft Outlook 2013
- Microsoft Outlook 2016
- Microsoft Outlook 2019
- Microsoft Outlook 2021
- Microsoft Outlook for Microsoft 365
Scores
- Severity
- high
- CVSS v2
- 7.6
- CVSS v3
- 7.5
- CVSS v4
- —
- EPSS
- —