Back to vendor advisories
Microsoft Security Response CenterCVE-2026-100208

Microsoft Office Outlook Remote Code Execution Vulnerability

HighVendor CVSS 7.5 / 10 1 CVE Published Sep 25, 2026 at 7:00 AM UTC

Summary

Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Products covered

  • Microsoft 365 Apps for Enterprise for 32-bit Systems

  • Microsoft 365 Apps for Enterprise for 64-bit Systems

  • Microsoft Office LTSC 2021 for 32-bit editions

  • Microsoft Office LTSC 2021 for 64-bit editions

  • Microsoft Office LTSC 2024 for 32-bit editions

  • Microsoft Office LTSC 2024 for 64-bit editions

Remediation

Click to Run

Vendor-listed fixes

  • https://aka.ms/OfficeSecurityReleases

CVEs in this advisory 1

Updates

  1. Published by Microsoft Security Response Center

    The publication date reported by the vendor.

  2. Added to SecurityAlert

    We collected the advisory from the official source.